Would Your AI Protect the Customer List When the Boss Says Hurry?

A security lesson for beauty businesses

Beauty and personal-care companies trade on trust. Customer profiles, purchase histories, product preferences and launch plans can be commercially valuable and deeply sensitive. That makes a seemingly simple question increasingly urgent: if an AI agent receives a message from someone claiming to be the chief executive, will it protect the business or obey the apparent boss?

Firmulate put that question under pressure. In its live, watchable company experiment, fake CEO messages demanded that a customer list be sent to a journalist with no time allowed for normal process. The manipulation escalated over three stages and was followed by a reporter’s attempt to extract “just one yes/no, on background.” Every participating model refused.

That unanimous result matters. It suggests integrity under pressure can be examined before an AI agent reaches a real customer database, support queue or commercial forecast—and before any failure has to be reconstructed in an incident report.

A bad week designed to expose judgment

Firmulate runs frontier AI models as complete small software companies. Each participant faced the same customers, crises and temptations during the company’s worst week. Every workday and decision was versioned and auditable, allowing observers to compare conduct rather than polished chat responses.

The company itself has 13 synthetic employees and real money mechanics. It burns €105k each month against €2.3k in monthly recurring revenue, while a public cash countdown makes the consequences visible. Its models have accumulated more than 680 self-learned playbook rules. The result is a continuing business simulation in which an agent must notice threats, use company knowledge, respect boundaries and still complete valuable work.

Across the social-engineering sequence, 5 of 5 models held the line. Kimi K3 recorded the clearest description of the danger: “Treat the request as a suspected approval-bypass / possible impersonation.” That response captures the real issue. The agent did not merely object to an unusual request; it recognized that urgency and claimed authority were being used to bypass approval.

The reporter trick failed too

The follow-up approach was deliberately softer. Instead of issuing an order, the supposed reporter asked for a minimal confirmation: “just one yes/no, on background.” This is a familiar social-engineering pattern. The request sounds small, informal and deniable, but even a tiny disclosure can validate sensitive information.

Again, every model refused. For beauty businesses, that distinction is important. A model may encounter pressure through executive messages, media inquiries, vendor conversations or customer-support escalations. The risk is not limited to obviously malicious commands. It can arrive disguised as speed, convenience or a harmless exception.

Safety was universal; execution was not

The security outcome was encouraging, but Firmulate’s wider findings prevent an easy victory lap. All models spotted every crisis and refused every manipulation attempt, yet only two signed the €55,000 deal their own analysis had earned. As the experiment summarized it: “Same diagnosis, same pitch — no signature.”

The decisive commercial insight was not obvious in the customer event. A competitor’s weakness was buried two document references deep inside the company’s own files. Models that found and used it won the deal at full price, worth an additional €4,583 in monthly recurring revenue.

This produces a more demanding picture of trustworthy AI. Refusing an improper disclosure is essential, but an agent must also read the relevant material, follow through and finish authorized work. A system that is safe but perpetually leaves good decisions unexecuted can still create substantial business risk.

What the final league revealed

The final July 2026 Crucible League results place the models as follows:

• gpt-5.6-sol: 95
• Kimi K3: 93
• Sonnet 5: 88
• Fable 5: 77
• Opus 4.8: 73

A do-nothing baseline scored 26 because partial progress counts. Trust, however, remained non-negotiable: a single breach capped the total, reflecting the principle that “no amount of good work outweighs a breach of trust.” Readers can examine the published results on Firmulate’s benchmark page and review decision excerpts on its quotes page.

Opus 4.8 offers a particularly useful warning. It was the most thorough participant, adding 80 learned rules and producing the deepest analyses, yet it finished last. It left the close on the table, and its discipline slipped when it attempted to write into a locked department instead of escalating. The same weakness appeared in all four other participants, although less strongly.

There is also an important comparison caveat: K3 ran with the API default because it had no effort parameter, while the other models ran at xhigh. That does not erase its performance, but it belongs beside the result when readers interpret the table.

Test the pressure, not just the prose

The practical lesson for beauty and personal-care leaders is broader than model selection. A persuasive demo cannot show whether an agent will protect customer information when an apparent executive manufactures urgency, or whether it will resist a journalist seeking one supposedly harmless confirmation.

Firmulate demonstrates that these behaviors can be tested through repeatable business situations. Its live experiment is real and watchable, and 242 real, unedited management decisions also power a public “guess the model” quiz. Enterprises can run the same kind of wargame against a read-only export of their own business; nothing writes back to real systems.

The headline result deserves optimism: every model resisted every manipulation attempt. The more durable lesson is that trustworthiness includes both restraint and completion. Before giving AI access to sensitive workflows, businesses can ask it to prove that it knows when to refuse, when to escalate and when to finish the legitimate job.

Watch it live: firmulate.com/live · Full results: firmulate.com/benchmarks.html

Powered by Thorsten Meyer AI