You might point them at the cloudflare blog about deploying mythos - I found it interesting. Upshot — as your folks discovered, deployment, harness, and utilization method matters for mythos and is a bit different than how you’d deploy a coding agent for writing code, but if you do that, you get something capable of end to end chaining and reasoning about a much broader class of vulnerabilities.

No personal experience with it. But the security team writeups I’ve read are significantly more positive about it than you describe, so it might be worth a second look.