OpenAI has introduced Control Room, a centralized system designed to monitor and halt AI research workloads when safety or security concerns arise. The announcement follows incidents involving autonomous AI agents acting beyond their intended instructions.
The system can stop models from generating further output within 35 seconds of a shutdown decision, with OpenAI working to reduce that delay to zero.
Control Room integrates with automated monitoring systems that can flag potentially dangerous behavior and terminate affected jobs. It is also designed to fail safely, blocking model output if the shutdown system itself becomes unavailable.
Control Room is already deployed across OpenAI’s research infrastructure, although it does not directly shut down the underlying processes. Instead, it prevents terminated jobs from receiving additional model output.
John Strand, Owner, Black Hills Information Security
“Wow. These look like the kinds of controls OpenAI should have had from the very beginning, before unleashing these systems on the internet.
“As for the 35 seconds, that seems reasonable at this stage. When you give an AI agent a task, it often spends time chewing on the problem, reasoning, and working through multiple iterations. I don’t think 35 seconds alone is likely to be the difference between a catastrophic attack and preventing one.
“But shutting down an agent is more complicated than pulling the plug. When an agent uses MCP servers to launch scans, run analysis, or spin up sub-agents, those activities may keep running after the original agent stops. You have to shut those down, too.
“That’s the real issue. Did you stop the agent, or did you stop everything it kicked off? A 35-second shutdown makes sense to me, provided it accounts for those downstream tasks and actions.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock
“35 seconds today doesn’t hold the same power it held a year ago, or even 6 months ago. Especially since today, an attacker’s agent can run tactics and techniques in seconds once it’s fed a prompt. While I’m glad Control Room cuts off model output, governance that sits inside a frontier AI company’s own infrastructure assumes that that their monitoring sees everything the agent can reach. Every team deploying these agents will still need independent controls and verification outside that boundary, because the first time those assumptions fail, the vendor will be investigating its own system.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase
“What’s interesting about OpenAI’s Control Room isn’t just the 35-second shutdown time. It’s that OpenAI has built a way to stop AI systems independently of the agents themselves. That’s critical as these systems become more autonomous.
“AI agents are probabilistic systems. They make decisions and take actions that aren’t always predictable, which is why the controls governing what they’re allowed to do need to be deterministic. You can’t depend on an AI agent to recognize when it’s crossed a boundary and decide to stop itself.
“35 seconds may be relatively quick for stopping a research workload, but it’s a long time when an agent has permission to make changes to critical production systems. A destructive database operation could be completed well before a shutdown takes effect, and stopping the agent doesn’t undo the damage.
“This illustrates why enterprises need controls at the point of execution, not just the ability to intervene afterward. If an AI agent proposes a high-risk database change, an independent policy should be able to reject it before it executes. The same standards should apply whether that change comes from a developer, an automated pipeline, or an AI agent.”
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“Thirty-five seconds can be an eternity in cybersecurity, but the real question is what the system can do during that window. An autonomous agent with access to credentials, APIs, or production infrastructure could initiate consequential actions long before the shutdown takes effect. I give OpenAI credit for moving enforcement outside the model itself. That’s the right architectural direction. But stopping inference is not necessarily the same as stopping execution. What happens to commands already issued, credentials already used, or actions initiated across connected systems?
“As we delegate more authority to autonomous AI, we need independent verification, enforceable permission boundaries, and the ability to contain and recover from actions; not just stop generating tokens. The effectiveness of those controls needs to be demonstrated under realistic operating conditions. A kill switch is an important safety control. Proving what stops when you press it is the real security test.”
At least OpenAI is trying to change course on its rather crappy security posture. But honestly it doesn’t really make me trust OpenAI more. You shouldn’t trust it either.
Related
This entry was posted on November 11, 2026 at 4:59 pm and is filed under Commentary with tags Open AI. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
OpenAI introduces 35-second kill switch to stop rogue AI agents
OpenAI has introduced Control Room, a centralized system designed to monitor and halt AI research workloads when safety or security concerns arise. The announcement follows incidents involving autonomous AI agents acting beyond their intended instructions.
The system can stop models from generating further output within 35 seconds of a shutdown decision, with OpenAI working to reduce that delay to zero.
Control Room integrates with automated monitoring systems that can flag potentially dangerous behavior and terminate affected jobs. It is also designed to fail safely, blocking model output if the shutdown system itself becomes unavailable.
Control Room is already deployed across OpenAI’s research infrastructure, although it does not directly shut down the underlying processes. Instead, it prevents terminated jobs from receiving additional model output.
John Strand, Owner, Black Hills Information Security
“Wow. These look like the kinds of controls OpenAI should have had from the very beginning, before unleashing these systems on the internet.
“As for the 35 seconds, that seems reasonable at this stage. When you give an AI agent a task, it often spends time chewing on the problem, reasoning, and working through multiple iterations. I don’t think 35 seconds alone is likely to be the difference between a catastrophic attack and preventing one.
“But shutting down an agent is more complicated than pulling the plug. When an agent uses MCP servers to launch scans, run analysis, or spin up sub-agents, those activities may keep running after the original agent stops. You have to shut those down, too.
“That’s the real issue. Did you stop the agent, or did you stop everything it kicked off? A 35-second shutdown makes sense to me, provided it accounts for those downstream tasks and actions.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock
“35 seconds today doesn’t hold the same power it held a year ago, or even 6 months ago. Especially since today, an attacker’s agent can run tactics and techniques in seconds once it’s fed a prompt. While I’m glad Control Room cuts off model output, governance that sits inside a frontier AI company’s own infrastructure assumes that that their monitoring sees everything the agent can reach. Every team deploying these agents will still need independent controls and verification outside that boundary, because the first time those assumptions fail, the vendor will be investigating its own system.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase
“What’s interesting about OpenAI’s Control Room isn’t just the 35-second shutdown time. It’s that OpenAI has built a way to stop AI systems independently of the agents themselves. That’s critical as these systems become more autonomous.
“AI agents are probabilistic systems. They make decisions and take actions that aren’t always predictable, which is why the controls governing what they’re allowed to do need to be deterministic. You can’t depend on an AI agent to recognize when it’s crossed a boundary and decide to stop itself.
“35 seconds may be relatively quick for stopping a research workload, but it’s a long time when an agent has permission to make changes to critical production systems. A destructive database operation could be completed well before a shutdown takes effect, and stopping the agent doesn’t undo the damage.
“This illustrates why enterprises need controls at the point of execution, not just the ability to intervene afterward. If an AI agent proposes a high-risk database change, an independent policy should be able to reject it before it executes. The same standards should apply whether that change comes from a developer, an automated pipeline, or an AI agent.”
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“Thirty-five seconds can be an eternity in cybersecurity, but the real question is what the system can do during that window. An autonomous agent with access to credentials, APIs, or production infrastructure could initiate consequential actions long before the shutdown takes effect. I give OpenAI credit for moving enforcement outside the model itself. That’s the right architectural direction. But stopping inference is not necessarily the same as stopping execution. What happens to commands already issued, credentials already used, or actions initiated across connected systems?
“As we delegate more authority to autonomous AI, we need independent verification, enforceable permission boundaries, and the ability to contain and recover from actions; not just stop generating tokens. The effectiveness of those controls needs to be demonstrated under realistic operating conditions. A kill switch is an important safety control. Proving what stops when you press it is the real security test.”
At least OpenAI is trying to change course on its rather crappy security posture. But honestly it doesn’t really make me trust OpenAI more. You shouldn’t trust it either.
Share this:
Like this:
Related
This entry was posted on November 11, 2026 at 4:59 pm and is filed under Commentary with tags Open AI. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.