OpenAI has developed and deployed a system called Control Room to centrally monitor research model workloads and rapidly halt their outputs when safety or security concerns arise. The system was created in response to growing risks associated with increasingly capable models and aims to make timely intervention possible across the research infrastructure.
How it works
Control Room tracks inference workloads across research: agentic sampling for training and evaluation, high-volume sampling, data processing and other job types. It works alongside OpenAI's misalignment monitoring tools and is designed to stop further model output within a maximum of 35 seconds after a decision to intervene. That 35-second maximum stems from a caching layer used to support high authorization traffic; the company says it is working to reduce this latency toward zero.
The architecture involves three main components:
- the workload (job), such as a reinforcement learning experiment, an evaluation run or a large-scale data job;
- the inference engine (engine), i.e., the model runtime that executes on GPUs;
- the centralized Control Room service that records jobs and allows or denies inference requests.
Every research workload that performs agentic inference is required to be associated with an approved safety case and to request a job_id from Control Room when it starts. The workload then includes that job_id in each inference request sent to an engine.
Before fulfilling a token-sampling or other inference request, the engine queries Control Room to confirm that the corresponding job_id remains authorized. If Control Room indicates the job has been stopped, the engine refuses the request and returns a denial instead of model output. The workload process can remain running, but no further model responses are produced for that job.
Integration with monitoring
Frontier reinforcement learning jobs also run monitoring models that inspect the trainee model's behavior and raise alerts if they detect issues; OpenAI cites a recent DNS-related incident as an example that was caught by a monitor. If the monitoring system determines a problem warrants stopping the job, it sends a stop message to Control Room with the job_id. From that point, any subsequent inference request bearing the job_id will be denied by Control Room, preventing further output.
Reliability and fail-safe behavior
Because workload code is diverse and changes frequently, OpenAI implemented the termination mechanism at the inference layer, which is more centralized and consistent across research. This provides a dependable chokepoint for authorization checks. The company also conducts continuous sweeps to detect attempts to run engine implementations that bypass or disable Control Room.
Control Room is configured to “fail closed”: if the Control Room service becomes unavailable—because of an error, deliberate disablement, or tampering—then all inference requests are denied until the service is restored. Fail-closed is already being rolled out to frontier model research workloads and will be extended to the remaining research workloads over the next few days.
Deployment and significance
Control Room has been deployed first where the risks are greatest: across internal research infrastructure. External model-serving infrastructure, by contrast, tends to be more centralized and already has operational capacity to rapidly take down model deployments when necessary. Control Room augments these safety layers and is presented as an important element of OpenAI’s approach to safer frontier model training and deployment.
Next steps and hiring
Control Room is one component of a broader safety strategy that includes monitoring for misaligned behavior and detecting security breaches. OpenAI says it will continue to strengthen and expand the system in the coming months and is hiring people interested in building safe and secure systems for AGI development and deployment.
Technical flow summary
- Researcher launches a job; workload requests a job_id from Control Room and associates it with an approved safety case.
- Inference requests include the job_id and are sent to engines; engines check Control Room for authorization before fulfilling requests.
- If Control Room grants permission, the engine returns model output; if not, the engine refuses the request and no output is produced for that job.
- Monitoring systems can instruct Control Room to stop a job; subsequent inference checks for that job_id are denied.
The current upper bound on time from a stop instruction to the point where further progress is blocked is 35 seconds; OpenAI is working to reduce that lag.
(body_en end)
