The report
OpenAI described an internal Control Room for research workloads that lets operators or monitors stop further model inference even when the running research code does not cooperate. The system attaches each research job to an approved safety case and makes model-serving engines check that job identifier before returning new inference output. The company reports a maximum 35-second interval from receipt of a stop instruction to cessation of further model progress, due to cached authorization.
Stop at a bottleneck the agent cannot edit
According to the technical description, the workload receives a job_id, passes it to an inference engine and is authorized through the Control Room service. When the job is marked stopped, an engine must refuse subsequent inference requests even if the original workload continues running. This design moves the critical check out of rapidly changing researcher-owned processes and into the smaller set of centrally managed inference paths.
The company also describes continuous sweeps for engines that might be running without the required integration, and a fail-closed design when Control Room itself is unavailable. These are reported internal controls; the public account does not provide an independent exercise of every engine or an externally audited deployment guarantee. The described 35 seconds measure a particular interval after an accepted stop, not the time to detect a problematic agent in the first place.
Model cessation does not undo an earlier effect
An agent might already have sent a message, executed a shell command, transferred credentials or modified a database before inference is blocked. A research process can remain alive after new model output stops. By contrast, the OpenShell runtime design places checks on selected network and credential effects outside an executing agent. These are complementary interception points, not interchangeable promises. The controlled Claude-memory command-channel demonstration highlights a separate route through which a previously compromised host can execute actions under an agent's credentials.
A complete stop drill should timestamp alert generation, acceptance by the central controller, final authorized token output, queued tool invocations, pending outbound transfers and completed external effects. Tests should include authorization-cache expiry and a controller outage. The reported mechanism narrows the window for further inference in the research stack; it does not establish a rollback system for everything an agent may have already changed.