Put agent permissions outside the agent’s own instructions
OpenAI’s Control Room and Datadog’s observed ARTEX attacks illustrate two distinct controls: revoking access to model output and limiting what cloud credentials can do.
An agent that keeps asking for an action should not automatically retain the authority to perform it.
Two November 9 disclosures make that engineering principle concrete. OpenAI describes Control Room, which authorizes inference for research jobs. Datadog documents agent-assisted attacks against AWS environments, including a narrowly scoped identity whose permissions blocked attempted discovery calls. [1][2]
Control Room sits in the inference path rather than trusting each experiment’s changing code to stop itself. OpenAI says it can deny further model output within at most 35 seconds of a stop decision; the delay comes from cached authorization. The research process can remain alive. This is an internal research control, not a new emergency-stop feature for ChatGPT users. [1]
The ARTEX example concerns cloud permissions, not model shutdown. Its lesson is that an agent’s persistence does not make an insufficient credential more powerful. For systems you commission, review both boundaries: what can the agent reach, and what independent mechanism can withdraw that access? Require a test of revocation and record the delay, rather than treating a prompt instruction as the control. [2]
Sources & details 3 sources
Discuss in your voice app
Take the reporting, visual explanations and original sources into a conversation. Copy the brief, paste it into your preferred assistant, then start its voice mode.
Paste the brief into your voice app to discuss this reporting.Reporting sources
- OpenAI — Control Room
Correct original URL found via dated official newsroom. OpenAI reports up-to-35-second stop-to-inference-denial, due to authorization cache. Job process can remain alive; not a ChatGPT/API feature. Fail-closed already on frontier research; remaining research rollout pending in announcement. Self-report, no external latency audit.
- Datadog Security Labs — ARTEX investigation
Datadog observed October and early-November activity using compromised long-lived credentials/public Cognito; one narrowly authorized identity-pool role blocked all attempted read-only discovery. Do not generalize that all attacks failed or all agentic attacks need sophisticated exploits. Vendor investigation/attribution, not reproduced forensic investigation by us.
- OpenAI — monitoring and intervention architecture
October 29 background documents monitoring, alert review and intervention as separate layers. It is provider documentation, not an independent measurement of Control Room’s 35-second cutoff.
Images & figures
A separate control can deny execution even when an agent continues making requests.
Euangelion · Source · Usage terms