Cisco has posted their assessment of Anthropic’s latest model and it is close to the opposite of “Mythos is working for them.” Their post emphasizes most that the model is interchangeable. They ran six frontier models (Mythos and GPT-5.5-Cyber named among them) on 1.8 billion lines of code to show their results are not tied to any one of them. The line they keep returning to is that the model is an accelerant while the harness is the engine.

Of course we have to pause and reflect on why it’s an executive post by their Chief Security & Trust Officer yet it carries no disclosed methodology. Does Cisco think trust comes from lack of transparency? I get that the Cisco security executive is selling Cisco’s harness as a counter-argument to Anthropic. I’m just curious why it’s lacking the kind of specificity a harness buyer would be looking into. Fun history fact: the first “Chief Information Security Officer” job was invented in 1995 for Steve Katz to calm Wall Street after Russians popped the funds-transfer system.

But I digress. The sub-3% false-positive rate being claimed by Cisco in their post is clearly a measure of their human-in-the-loop after triage. It cannot be attributed to the model, and it cannot be attributed to the harness either. It is a measure of people filtering machine output.

From there the post gets weird because it tries to contrast legacy static analysis (one finding per ten thousand warnings) against Cisco’s false-positive rate. One is a precision number, the other a false-positive number. That doesn’t add up.

Maybe I shouldn’t be surprised. Despite claims to being agnostic, no per-model variance is published. And their post headline has the same problem. “Eight years of work in eight weeks” is supposed to sound like they made a measurement. They didn’t. Cisco ran the scan in eight weeks. And then they made up an eight years estimate. Nobody worked eight years. It’s a guess about how long humans take to do something, without revealing how they cooked the estimate. Guess any slower and the number gets bigger. Guess faster and it shrinks. Why not eight gabookles? I believe them on lines scanned and the languages covered. The eight years sounds like management hallucination.

The figures Cisco published cannot be reproduced from anything Cisco released. If Cisco wanted to throw Anthropic under a bus (I almost said off a bridge), this is how it’s done.