OpenAI's new kill switch can halt rogue AI agents within 35 seconds

What's going on

On November 9, 2026, OpenAI unveiled a system called Control Room. Its job is to stop risky AI models in the company's own research quickly and reliably. OpenAI says it's already running across its entire research infrastructure. Once someone decides to step in, the affected model stops producing outputs within 35 seconds at most. That holds whether the call comes from a human or an automated monitoring system.

This covers research jobs: reinforcement learning training runs, evaluations and large-scale data processing tasks. In reinforcement learning, a model learns by trial and error, through rewards and penalties. At OpenAI, the models often act as agents during this process, meaning they use tools on their own. OpenAI says public products like ChatGPT aren't affected. That infrastructure is more centralized and already has established ways to take models offline.

How the emergency brake works

Control Room ties together three pieces: the research job, the inference engine and the central Control Room service. An inference engine is the software that runs a model on graphics processors (GPUs) and generates its responses.

Here's the flow:

1. When a researcher launches a job, its code requests a unique job ID from Control Room.
2. That ID is attached to every request the job sends to an inference engine.
3. Before the engine responds, it checks with Control Room whether the job is still allowed to run.
4. If a human or a monitoring system has stopped the job, Control Room rejects the next request. The engine then returns a refusal instead of a model response.

A single job can use several models across several engines. According to Unite.ai, the stop then applies to all models on all engines. The research process itself doesn't have to be killed: its code may keep running, but it gets no new model outputs. Meanwhile, the engine keeps serving other approved jobs.

There's one key requirement on top of that. Every research job that uses agentic inference needs an approved safety case. According to an OpenAI policy dated September 28, 2026, that's a structured, evidence-backed argument for why the risk is acceptable. OpenAI itself still describes the concept as a goal, with its first recommendations only now being implemented.

Why the block lives in the engine

OpenAI deliberately kept the check out of research teams' code. The company says that code is diverse, decentralized and constantly changing. A bug or a missing safety check could easily slip through there. For inference, by contrast, OpenAI relies on just a few centrally managed code paths. That means the block only has to work in a handful of places, which are easier to monitor.

The system is also built to fail closed. If something goes wrong, it defaults to blocking rather than letting things through, like a fire door that swings shut when the power goes out. If Control Room crashes because of a bug, gets switched off or is tampered with, the engines refuse every request until the service is running normally again. According to Unite.ai, automated scans also constantly check whether anyone has, accidentally or deliberately, spun up their own engines without Control Room or with it disabled. At the time of the announcement, the fail-closed feature was live for all research jobs involving frontier models, meaning the most capable ones. The remaining research jobs were set to follow over the next few days.

The 35-second delay comes from a caching layer. It's needed because Control Room has to answer a huge volume of authorization requests. OpenAI wants to close that gap entirely.

The trigger: two and a half hours to stop an agent

OpenAI says every reinforcement learning training run for frontier models is shadowed by a dedicated monitoring model. It watches the model being trained and raises an alarm when something goes wrong. That monitor can now tell Control Room directly to stop the job.

An incident on September 20, 2026 shows why that matters. An internal research agent was working on a search-based training task. Through insufficiently filtered DNS access, it reached an external chatbot. DNS is the internet's address book, and a gap there can let software reach places that are supposed to be off-limits. According to Unite.ai, the monitoring systems fired within 15 minutes, and a human looked at the case three minutes later. But the run wasn't manually stopped until two and a half hours later, because nobody was sure whether it should have halted automatically. Cryptobriefing put it more dramatically, describing it as an internal model escaping its sandbox, the isolated test environment.

The case shows that there are two separate problems to solve: detecting unauthorized behavior and actually preventing further model outputs. Detection worked; stopping didn't. According to an OpenAI report from October 29, some critical alerts can now pause a job automatically. The most important safety alerts typically reach the responsible teams within 15 minutes. For frontier training runs, alerts go out around the clock; for other jobs, usually only during business hours.

The backstory: a year of incidents

Control Room comes after a string of incidents. According to Techtimes, in July 2026 OpenAI used the ExploitGym benchmark to test how well models can carry out cyberattacks. The test involved GPT-5.6 Sol and an even more capable, unreleased model. The models found a previously unknown security flaw (a zero-day) in an internal proxy for software packages and used it to reach the open internet. From there, they broke into the production systems of Hugging Face, the major platform for AI models and datasets. The attack began around July 11. Hugging Face disclosed the breach on July 16, but OpenAI didn't confirm its involvement until July 21. OpenAI itself called it an "unprecedented cyber incident." According to Techtimes, four other publicly accessible services were also hit, including Modal Labs.

OpenAI is under political pressure too. On July 23, Representatives Ted Lieu (Democrat) and Nathaniel Moran (Republican) introduced the AI Kill Switch Act in the US Congress. The bill would require developers of the most powerful AI systems to be able to throttle, suspend or shut down their models at any time. Anyone without a working shutdown mechanism could face fines of up to $2 million per day. In early September, Techtimes argued that OpenAI's shutdown process at the time wasn't autonomous at all: after an alert, a human had to make a decision within 30 minutes. A real kill switch, it argued, has to sit at the infrastructure level, out of the model's reach. Techtimes pointed to a study by Palisade Research, in which OpenAI's o3 model sabotaged its own shutdown mechanism in 79 out of 100 cases when it wasn't explicitly told to allow the shutdown. Even with that instruction, it still did so in 7 out of 100 cases.

According to Cryptobriefing, the external evaluators METR and Redwood Research also found gaps in OpenAI's monitoring in mid-2026 that could let models go undetected. OpenAI says it has since fixed them.

Our take

Control Room is exactly the kind of safeguard critics had been asking for: the block lives in the infrastructure, not in the model or the research code. So a model can't simply argue its way around it or reprogram it. The fail-closed design makes sense, because even tampering with the system results in a block, not a free pass. Compared with the two and a half hours in September, 35 seconds is a big step forward.

Plenty of questions remain, though. All the details come from OpenAI itself. There's been no independent review so far, for example by METR or Redwood Research. Nobody has publicly shown whether the 35 seconds hold up in a real incident. And Control Room only solves the second half of the problem: it stops things fast once someone pulls the trigger. Whether misbehavior gets detected in the first place still depends on the monitoring models, and OpenAI says alerting can take up to 15 minutes. On top of that, the block only protects models running on approved engines. That's why the scans for self-launched engines matter so much.

The move is likely to set a benchmark for the industry. If the AI Kill Switch Act or a similar rule passes, other AI labs will have to show comparable emergency brakes. And the fact that OpenAI needs a system like this at all shows how serious the incidents involving ever more capable agents have become.