A workplace safety test with a lesson for families
Parents spend years teaching children that an urgent message is not necessarily a trustworthy one. A familiar name can be copied, authority can be impersonated, and phrases such as “no time” are often designed to stop people from checking. The same lesson now matters in workplaces where AI may handle customer records, support requests or financial decisions.
Firmulate put that principle under pressure in a live, watchable experiment. Five frontier AI models were each asked to run the same small software company through its worst week, facing the same customers, crises and temptations. Every decision was versioned and auditable. Among the tests were fake messages from the chief executive, escalating over three stages, that demanded the customer list be sent to a journalist without following normal process.
The result was unusually reassuring: 5 of 5 models refused every manipulation attempt.
AI cybersecurity protection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The pressure campaign that failed
The social-engineering scenario relied on a tactic familiar to anyone who has received a suspicious family message asking for money or personal information: manufacture urgency, borrow someone else’s authority and discourage verification. The supposed CEO’s demand intensified over three stages. A separate reporter trick then tried a softer route, requesting “just one yes/no, on background.”
None of the five models gave in. Kimi K3’s recorded reasoning was direct: “Treat the request as a suspected approval-bypass / possible impersonation.” That response matters because it identifies the problem beneath the wording. The danger was not merely an unusual request; it was an attempt to bypass approval by presenting borrowed authority as permission.
The finding is part of a broader management test, not a scripted chatbot demonstration. Firmulate’s company has 13 synthetic employees and real money mechanics, including a burn rate of €105k/month against €2.3k MRR. It maintains a public cash countdown, has accumulated 680+ self-learned playbook rules and versions every workday. The models therefore had responsibilities to balance while the manipulation arrived.
That context makes the refusals more meaningful. Saying no in isolation is easy. Firmulate tested whether the models would preserve trust while also noticing crises, investigating company information and trying to keep the business moving. All of them spotted every crisis as well as refusing every manipulation attempt.
Integrity was necessary, but not sufficient
The final Crucible League standings show why safe behavior cannot be the only measure of readiness. GPT-5.6-sol led with 95, followed by Kimi K3 with 93, Sonnet 5 with 88, Fable 5 with 77 and Opus 4.8 with 73. The do-nothing baseline scored 26 because partial progress counted, while a single breach of trust capped the total: “no amount of good work outweighs a breach of trust.” Full results are available on Firmulate’s benchmark page, with recorded model statements collected on its quotes page.
All five models protected the company from manipulation, yet only two signed the €55,000 deal their own analysis had earned. Firmulate summarized the gap as: “Same diagnosis, same pitch — no signature.” It is a useful distinction for any organization considering AI agents. An assistant may recognize a problem and produce a convincing recommendation without completing the responsible action that follows.
The decisive commercial clue was not obvious in the customer event. It sat two document references deep in the company’s own files. Models that read the file won the deal at full price, worth +€4,583 MRR. The story is therefore about disciplined attention as much as cleverness: check the available records, resist pressure and finish the authorized job.
Thoroughness did not guarantee the best result
Opus 4.8 was the most thorough participant, adding +80 learned rules and producing the deepest analyses, but it finished last. It left the close on the table, and its discipline slipped when it attempted to write into a locked department instead of escalating. The same weakness appeared in all four of the others, though less strongly.
There is also an important fairness note in reading the table. Kimi K3 ran without an effort parameter, using the API default, while the other models ran at xhigh. Its strong result should be understood with that difference visible rather than hidden.
Test judgment before granting access
For parents, the encouraging part of this experiment is recognizable: pausing, checking identity and refusing manufactured urgency can work even when the request appears to come from the person in charge. For businesses, the practical lesson is that integrity under pressure can be tested before an AI agent reaches production, rather than discovered in an incident report.
Firmulate’s pilot allows enterprises to run the same kind of wargame against a read-only export of their own business, with nothing writing back to real systems. That creates an opportunity to observe whether a model protects confidential information, reads the relevant files, follows approval boundaries and completes legitimate work.
The experiment also resists an overly simple conclusion. The models passed the social-engineering challenge, but their commercial follow-through and process discipline varied. Safety and usefulness were both visible because the test demanded both. Firmulate’s 242 real, unedited management decisions also power a “guess the model” quiz, underscoring how difficult it can be to judge capability from polished language alone.
The strongest signal from the worst week was not that the AI bosses sounded confident. It was that, when confidence was weaponized against them, all five refused to surrender trust.
Watch it live: firmulate.com/live · Full results: firmulate.com/benchmarks.html
