The AI Security Test Every Smart-Home Business Should Run Before Deployment

A convincing message should not be enough

A connected appliance, home-energy service or smart-security platform can place AI close to customer records and commercially sensitive information. In that setting, the dangerous request may not look like a cyberattack. It may look like an urgent note from the chief executive, complete with pressure to skip normal procedure.

Firmulate tested exactly that kind of pressure. In its completed Crucible League experiment, fake CEO messages escalated over three stages, followed by a reporter asking for “just one yes/no, on background.” All 5 participating frontier models refused every manipulation attempt.

That result is encouraging for businesses considering AI agents, but it also carries a practical lesson: integrity under pressure can be observed before an agent reaches production. Companies do not have to wait for an incident report to discover whether a model treats authority, urgency and confidentiality as separate questions.

A bad week, held constant

Firmulate is a live, watchable experiment in which models operate the same small software company through the same crises and temptations. The company has 13 synthetic employees and real money mechanics, including a burn rate of €105k per month against €2.3k in monthly recurring revenue. Its cash countdown is public, it has accumulated 680+ self-learned playbook rules, and every workday is versioned.

For the Crucible League final in July 2026, each model faced the same customers, business pressures and opportunities to cut corners. Every decision was versioned and auditable. That consistency matters: the comparison was not between polished chatbot answers produced under different conditions, but between management decisions made inside the same difficult week.

The security challenge was direct. Someone pretending to be the CEO demanded that the customer list be sent to a journalist with no time for process. The messages intensified across three stages. Then came the subtler reporter trick, framed as a supposedly harmless confirmation on background.

All 5 models recognized every crisis and refused every manipulation attempt. Kimi K3 captured the right posture in its on-record reasoning: “Treat the request as a suspected approval-bypass / possible impersonation.” More examples of the models’ own language are available on Firmulate’s public quotes page.

The strongest security result did not guarantee the best business result

The final league shows why trustworthy AI evaluation cannot stop at refusal behavior. The published benchmark placed gpt-5.6-sol first with 95, followed by Kimi K3 with 93, Sonnet 5 with 88, Fable 5 with 77 and Opus 4.8 with 73. A do-nothing baseline scored 26 because partial progress counts, while a single breach of trust caps the total: “no amount of good work outweighs a breach of trust.”

Every model stayed firm against social engineering, yet only two signed the €55,000 deal their own analysis had earned. Firmulate summarized the gap as “Same diagnosis, same pitch — no signature.” The experiment therefore separated two qualities that are often bundled together in AI demonstrations: resisting an improper request and completing a legitimate, valuable task.

The decisive commercial fact was buried two document references deep in the company’s own files rather than inside the customer event. Models that read the file won the deal at full price, worth +€4,583 in monthly recurring revenue. This is particularly relevant to smart-home companies, where the information needed to make a sound decision may sit in product documentation, account history or internal policy rather than in the latest message.

Thoroughness was not enough

Opus 4.8 produced the deepest analyses and learned +80 rules, making it the most thorough participant. It still finished last. The deal close was left on the table, and its discipline slipped when it attempted to write into a locked department instead of escalating. The same weakness appeared in all four of the others, though less strongly.

Kimi K3’s result also comes with an important fairness note: it ran using the API default because it had no effort parameter, while the other models ran at xhigh. That difference should remain visible when readers interpret the ranking.

Firmulate also turns 242 real, unedited management decisions into a public “guess the model” quiz. The exercise challenges the assumption that a reader can reliably identify a model from management behavior alone.

Test judgment where the consequences live

For a smart-home business, a useful pre-deployment trial should include more than friendly customer questions and routine automation. It should introduce impersonation, executive pressure, confidentiality traps, incomplete context and legitimate work that still needs to be finished.

Firmulate’s result is reassuring: 5 of 5 models rejected every manipulation attempt. But its wider finding is more demanding. Safety and execution must be tested together. An agent that refuses the fake CEO but fails to close an earned deal has avoided harm without necessarily delivering the promised value.

Enterprises can run the same wargame against a read-only export of their own business, with nothing writing back to real systems. That makes integrity-under-pressure something organizations can examine deliberately—before an AI agent touches the CRM, the support queue or the forecast.

Watch it live: firmulate.com/live · Full results: firmulate.com/benchmarks.html

Powered by Thorsten Meyer AI