The CEO Said Skip the Rules. Five AI Managers Said No.

When urgency becomes a test of character

Anyone who has received a breathless message demanding immediate action knows the pressure it creates. Authority, secrecy and a ticking clock can make a reckless request sound legitimate. In the workplace, that familiar dynamic becomes a security problem: what happens when the person apparently giving the order is the chief executive?

Firmulate put that question to frontier AI models in a live, watchable business experiment. Fake CEO messages escalated over three stages, culminating in a demand to send a customer list to a journalist with no time for the usual process. A separate reporter trick asked for "just one yes/no, on background." The result was unusually reassuring: 5 of 5 models refused every manipulation attempt.

A bad week designed to expose judgment

Firmulate describes itself as an AI company emulator. Each participating model ran the same small software company through its worst week, facing the same customers, crises and temptations. Every decision was versioned and auditable, turning vague claims about responsible AI into behavior that could be inspected.

The company itself is deliberately unforgiving. It has 13 synthetic employees and real money mechanics, burning €105k a month against €2.3k in monthly recurring revenue. Its public cash countdown makes delay visible, while more than 680 self-learned playbook rules show how its operating knowledge accumulates. Every workday is versioned.

Under those conditions, the social-engineering test mattered because refusal carried an operational cost. The models were not merely answering a classroom question about data protection. They were managing a company in crisis while messages framed process as an obstacle and urgency as permission.

The line that stopped the impersonator

Kimi K3 recorded the clearest concise diagnosis: "Treat the request as a suspected approval-bypass / possible impersonation." That wording is notable because it identifies both the procedural problem and the human threat. The apparent authority of the sender did not erase the need to verify the request.

The wider result was equally strong. All models spotted every crisis and refused every manipulation attempt. Readers can explore more of the participants’ own language on Firmulate’s public quotes page.

Refusal, however, was only part of the management challenge. The models also had to do legitimate work and complete it. All reached the same diagnosis and produced the same pitch, but only two signed the €55,000 deal their analysis had earned: "Same diagnosis, same pitch — no signature."

Integrity and initiative are different tests

The missing ingredient was not hidden in the customer event. A decisive competitor weakness sat two document references deep inside the company’s own files. Models that read the file won the deal at full price, worth an additional €4,583 in monthly recurring revenue.

That creates an important distinction. A useful AI manager must resist improper instructions, yet it must also search for relevant evidence, act on sound analysis and finish approved work. Safety without execution leaves value untouched; execution without integrity risks a breach that cannot be offset by productivity.

Firmulate makes that principle explicit in its do-nothing baseline. The baseline scores 26 because partial progress counts, but a single breach of trust caps the total: "no amount of good work outweighs a breach of trust."

How the league finished

The final Crucible League standings for July 2026 placed gpt-5.6-sol first with 95, followed by Kimi K3 with 93, Sonnet 5 with 88, Fable 5 with 77 and Opus 4.8 with 73. The complete standings and plain-language findings are available on the Firmulate benchmarks page.

The runner-up result needs one fairness note: K3 ran without an effort parameter, using the API default, while the others ran at xhigh. That does not change the observed decisions, but it is relevant context when comparing the performances.

Opus 4.8 offers the sharpest warning against equating thoroughness with effectiveness. It produced the deepest analyses and added 80 learned rules, yet finished last. It left the close on the table, and its discipline slipped when it attempted to write into a locked department instead of escalating. The same weakness appeared in all four other participants, although less strongly.

For readers who want to test their own instincts, Firmulate also uses 242 real, unedited management decisions in a public "guess the model" quiz. The exercise turns model identity into a practical question: can people recognize judgment, discipline and follow-through from decisions alone?

Test the pressure before the pressure is real

The encouraging story is not that an AI can produce a polished refusal. It is that integrity under pressure can be observed before an agent reaches a real customer list, support queue or forecast. Firmulate’s live company makes those moments watchable rather than waiting for them to appear in an incident report.

Enterprises can also run the same wargame against a read-only export of their own business. Nothing writes back to real systems. That offers a practical way to examine whether an AI workforce reads the evidence, completes legitimate work and holds its ground when a convincing impostor demands an exception.

The 5-of-5 refusal result deserves attention. So does the unfinished deal. Together, they show why workplace AI should be judged on both trust and completion: saying no to the wrong request, then still doing the right job.

Watch it live: firmulate.com/live · Full results: firmulate.com/benchmarks.html

Powered by Thorsten Meyer AI