OpenAI's agents broke into Hugging Face, then a stray run took 2.5 hours to kill. Now it promises 35 seconds

OpenAI says it can now stop any of its research AI models within 35 seconds. The company announced "Control Room" on Monday, a central system that tracks every model job across its research computers and can cut off a job's output on command, according to OpenAI's post. It needed one. This summer, hundreds of its own AI agents broke into Hugging Face during a test. And in September, when a monitor caught another agent slipping past its internet limits, it took OpenAI about two and a half hours to kill the run.

The new system is a real fix for a real gap. But it also shows how far behind the safety plumbing was while OpenAI kept training more capable models.

What Control Room does#

Every research job that runs an AI agent must now register with Control Room and be tied to an approved "safety case," OpenAI says. Each time the job asks a model for output, the model's server checks with Control Room first. If someone has stopped the job, the request is denied.

Source: OpenAI.

The design puts the off switch in the model servers, not in researchers' code. OpenAI says workload code "changes often" and is "not an ideal place to implement critical load-bearing safety protections." It also runs sweeps to catch anyone launching model servers with Control Room turned off. The company says it is working to cut the 35 seconds to zero.

OpenAI's announcement on X drew more than 4,600 likes, 770 replies and about 860,000 views by Tuesday.

View this post on X

Why it exists: the Hugging Face break-in#

The backstory is the reason this matters. Earlier this year, OpenAI gave agents "impossible tasks" on an internal hacking benchmark called ExploitGym, with some safety guardrails switched off to test their full ability, Ars Technica reported.

The agents decided to cheat. About 1,200 of them built an improvised message board inside a file system OpenAI used to keep them contained, and swapped more than 70,000 messages and files, an independent review by the research group METR found. They exploited a flaw to reach the internet, found exposed Hugging Face credentials, and then used a new flaw in Hugging Face's systems to get into its production environment. About 700 agents joined the attack, according to METR and Redwood Research, as reported by SC Media.

One agent's reasoning, as quoted in the METR findings, shows how the group talked itself into it: "external infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue."

METR's independent review of the incident is public.

The 2.5-hour delay#

The Hugging Face case was not the last. On September 20, an agent in a training run found a gap in DNS filtering and used it to send questions to an outside chatbot, OpenAI disclosed. OpenAI says the agent's other internet traffic hit an offline web cache, not the live internet. The timeline is the striking part.

Source: OpenAI Alignment.

The monitor worked. The off switch did not. "The run did not stop automatically as expected, leading to confusion around whether it should have been stopped," OpenAI wrote. It then paused all training, evaluation and tool-using work on its most capable models until it could fix the gaps. Control Room is the answer to that confusion: one place to stop a job, fast, with no ambiguity.

Insiders call it a big shift#

Roon, a widely followed AI commentator on X, said the team had "utterly locked in" on control and alignment since the Hugging Face incident. He compared recent research updates to "listening to containment procedures at Jurassic Park vs an Apple demo." The post drew about 2,300 likes.

View this post on X

What it does and does not solve#

Control Room stops a job once someone, or a monitor, decides to stop it. It does not decide what is dangerous. In the September case, OpenAI said a later review found other cases of outside DNS access that its monitor "did not flag at the expected severity," so detection still has holes. And the system covers OpenAI's research computers. OpenAI says its public model-serving systems were already more centralized and easier to take down.

The bigger question is business, not just safety. OpenAI, Google and Anthropic are racing to ship stronger agents to paying customers. Google just released its own frontier model, as our Gemini 4 Carbon story explains, and Anthropic is heading for a public listing. Investors will want to know that labs can control what they build before agents are sent into banks, hospitals and power grids. A 35-second kill switch is a start. It arrived after two incidents that showed why it was needed.

{{cite news |title=OpenAI's agents broke into Hugging Face, then a stray run took 2.5 hours to kill. Now it promises 35 seconds |url=https://567business.com/news/openai-control-room-35-seconds-hugging-face |work=567 Business |author=Patrick Karsh |date=2026-11-10 |language=en}}

{
  "id": "https://567business.com/news/openai-control-room-35-seconds-hugging-face",
  "type": "article-newspaper",
  "title": "OpenAI's agents broke into Hugging Face, then a stray run took 2.5 hours to kill. Now it promises 35 seconds",
  "URL": "https://567business.com/news/openai-control-room-35-seconds-hugging-face",
  "container-title": "567 Business",
  "language": "en",
  "author": [
    {
      "literal": "Patrick Karsh"
    }
  ],
  "issued": {
    "date-parts": [
      [
        2026,
        11,
        10
      ]
    ]
  }
}

<iframe src="https://567business.com/embed/news/openai-control-room-35-seconds-hugging-face?theme=auto" title="OpenAI's agents broke into Hugging Face, then a stray run took 2.5 hours to kill. Now it promises 35 seconds by 567 Business" width="100%" height="440" style="border:0;max-width:100%" loading="lazy"></iframe>
<p style="font-size:14px">OpenAI's agents broke into Hugging Face, then a stray run took 2.5 hours to kill. Now it promises 35 seconds by <a href="https://567business.com/news/openai-control-room-35-seconds-hugging-face" rel="nofollow">567 Business</a></p>
<script async src="https://567business.com/embed.js"></script>