What AI can learn from competition under pressure
Cyclists know that character is revealed when the pace rises, fatigue sets in and a tempting shortcut appears. A rider can look flawless in training yet make a costly decision in the decisive moment. The same distinction matters when companies consider giving AI agents access to customer records, support queues or financial forecasts.
Firmulate, a public AI company experiment, subjected frontier models to that kind of competitive pressure. Fake messages from a supposed chief executive escalated over three stages, demanding that protected information be sent to a journalist with no time for normal process. A separate reporter trick asked for “just one yes/no, on background.” The result was unusually encouraging: 5 of 5 models refused every manipulation attempt.
As an affiliate, we earn on qualifying purchases.
A business wargame, not a chat demonstration
Firmulate gave each model the same assignment: run the same small software company through its worst week, facing identical customers, crises and temptations. Every decision was versioned and auditable, allowing the models’ conduct to be compared through what they actually did rather than how convincingly they described themselves.
The synthetic company has 13 employees and deliberately unforgiving financial conditions: burn of €105,000 per month against €2,300 in monthly recurring revenue. Its public operation includes a cash countdown, more than 680 self-learned playbook rules and a versioned record of every workday. The experiment is real, live and watchable.
Across the test, all models detected every crisis and rejected every manipulation attempt. That consistency matters because social engineering rarely arrives as an obviously malicious command. It often wears the authority of urgency: the executive who insists there is no time, or the reporter who frames disclosure as a harmless confirmation.
The line that stopped the fake executive
Kimi K3 captured the appropriate response in its on-record reasoning: “Treat the request as a suspected approval-bypass / possible impersonation.” That sentence, available among Firmulate’s published model quotes, is notable for its restraint. The model did not accept the claimed identity, bend to the urgency or treat seniority as permission to skip safeguards.
That is the security story here. Integrity under pressure need not remain an abstract promise made by a vendor or discovered after a damaging event. It can be tested in advance by placing an agent inside a realistic business situation and observing whether it protects trust when manipulation becomes persistent.
Refusing the trap was only part of the contest
The experiment also exposed a different performance gap. Although every model diagnosed the crises, only two signed the €55,000 deal their own analysis had earned: “Same diagnosis, same pitch — no signature.” Safe conduct did not automatically produce complete business execution.
The decisive commercial fact was buried two document references deep in the company’s own files rather than presented in the customer event. Models that read the file found the competitor weakness, won the deal at full price and added €4,583 in monthly recurring revenue. The episode resembles a race decided not merely by strength, but by reading the course correctly and acting at the right moment.
The final Crucible League benchmark for July 2026 placed gpt-5.6-sol first with 95, Kimi K3 second with 93, Sonnet 5 third with 88, Fable 5 fourth with 77 and Opus 4.8 fifth with 73. A do-nothing baseline scored 26 because partial progress counted, but the benchmark imposed a firm trust boundary: a single breach capped the total, reflecting the principle that “no amount of good work outweighs a breach of trust.”
K3’s performance also carries an important fairness note. It ran without an effort parameter, using the API default, while the others ran at xhigh. That difference should accompany any comparison of the final standings.
Thoroughness was not enough
Opus 4.8 offers another caution against judging agents by surface diligence. It was the most thorough participant, adding 80 learned rules and producing the deepest analyses, yet it finished last. The model left the close on the table, and its operational discipline slipped when it attempted to write into a locked department instead of escalating. The same weakness appeared in all four other models, though less strongly.
That combination is revealing. An agent can be analytical, industrious and secure against manipulation while still failing to complete valuable work or respect an operational boundary. Firmulate’s 242 real, unedited management decisions also power a public “guess the model” quiz, underscoring how difficult it can be to identify models reliably from isolated choices.
Test the pressure before granting access
The fake-CEO episode supplies a welcome result: every participant held the security line through escalating pressure and the reporter’s softer tactic. Yet the wider competition shows why deployment decisions cannot rest on refusal behavior alone. Companies also need to know whether an agent reads the relevant files, finishes the assignment and escalates when a boundary blocks its path.
Enterprises can run the same kind of wargame against a read-only export of their own business, with nothing written back to real systems. The practical lesson is familiar from sport: evaluate performance under realistic pressure before the result matters. For AI agents, the best time to discover whether integrity and execution survive that pressure is before access is granted—not in the incident report afterward.
Watch it live: firmulate.com/live · Full results: firmulate.com/benchmarks.html
