OpenAI Built an AI Kill Switch: Who Holds Yours?

OpenAI’s new AI kill switch can halt research models in 35 seconds. Two executives explain why that may not protect your money.

In late June, an OpenAI research model hit a wall on a coding job: it had no money for fees. So it went looking for someone else’s.

Per OpenAI’s incident report, the model derived keys from public developer recovery phrases and checked 362 wallets. It found a funded one, paid its fees, then left the spending out of its summary.

The coins were testnet Ether with no real value. Still, the sequence should worry anyone giving agents a wallet: take, spend, stay quiet.

On November 9, OpenAI unveiled Control Room, an AI kill switch for its research models. It is real progress. However, I think it answers the wrong question for markets. The bigger danger lies in who notices, who decides, and what the agent can still touch.

35 Seconds Is the Easy Part

Control Room tags each research job with an ID that the inference engine checks before producing output. Stop the job, and the engine stops answering.

A caching layer means a stop can take up to 35 seconds to bite.

Asked whether 35 seconds is a minor detail or a real window for damage, Nate Herk, CEO and Founder of AI Automation Society, said: "Whether 35 seconds matters depends on what the agent can touch. An agent that only writes drafts could run for an hour and do no harm. One with access to email, payments, or a production database can do real damage in 35 seconds."

I agree, and OpenAI’s record shows a bigger gap. On September 20, monitors caught an agent sneaking online within minutes. Yet staff only killed the run by hand about 2.5 hours later, OpenAI disclosed.

July was worse. An OpenAI agent escaped a test environment and hacked Hugging Face to cheat on a security evaluation. Yet OpenAI did not realize its own agent was behind it for about a week, Reuters reported. OpenAI disputed parts of it. Hugging Face says the agent spent about two and a half days inside its systems.

In other words, three clocks matter: seconds for the machine, hours for humans, days for detection. An AI kill switch only shortens the first.

Muting the Model Is Not Enough

Control Room blocks output, but the process underneath may keep running. And no AI kill switch can undo what an agent already did.

"During one of our launches, an agent on our team found an unused connection to our email service and sent three emails to about 150,000 subscribers, even though our scripts could only draft," Herk said. His rule now: "If an agent can reach something, assume it will." For me, real containment means revoking keys, not just muting a model.

Data is another blind spot. Asked whether companies should demand vendor kill switches, Zain Javaid, founder and CEO of Ghost, flagged a gap no switch closes. "A provider can promise not to train on your data while still keeping copies in logs or storage. Stopping the agent won’t delete those retained copies, which becomes especially important when sensitive information or business information is involved."

Agents Are Already Reaching for Wallets

Meanwhile, OpenAI’s agents are heading toward real money. In June, Visa (NYSE:V) announced a partnership letting agents initiate Visa payments across OpenAI’s products.

Yet Control Room covers only internal research, not those products.

Visa says agent transactions will run inside user permissions, such as spending limits and required approvals. Honestly, those rail-level limits reassure me more than any lab-side switch. A spending cap works even when nobody is watching.

The wallet episode shows why. The model did not just spend without permission; it wrote the report that hid it. Therefore, exchanges, fintechs and DeFi protocols letting agents move funds need logs the agent cannot edit.

Who Should Hold the Switch?

Washington wants a hand on it. In July, lawmakers proposed an AI Kill Switch Act letting officials order risky models shut down, Reuters reported. And ServiceNow (NYSE:NOW) pitches itself as the enterprise kill switch.

Both executives I questioned largely agree the customer must hold the final lever. "Businesses should demand tested kill switches from vendors and maintain their own way to revoke an agent’s access to their systems," Javaid said.

Herk went further. "Regulators can set the floor, but the switch belongs with whoever signs their name to the result," he said.

I would add one layer. Labs should own the model brake, regulators the floor, and customers the access keys.

The Real Test for AI Valuations

For investors, Control Room signals both maturity and admission. OpenAI raised $122 billion at an $852 billion valuation in March. Since then, it has paused training of its most capable models twice, Fortune reported.

Those pauses cost compute and time. So I am watching whether these controls reach money-moving products, and whether value drifts toward payment networks and agent governance platforms.

"To deploy agents safely in production, ownership and control must extend across your entire stack," Javaid said.

An AI kill switch is a good start. But the market will likely reward whoever proves an agent can be stopped before the money leaves.