Cisco adds Claude Mythos to AI Defense for agent security testing

Claude Mythos will test AI agents for targeted weaknesses

Claude Mythos will augment Cisco AI Defense's adaptive red teaming framework, which lets security teams build customized, multi-step attacks against target systems. Cisco said the addition is designed to help defenders simulate realistic attacks and uncover risks in complex AI architectures before systems reach production.

According to Cisco, Claude Mythos can generate contextual attack paths, plan tests and translate results into attack ideas for individual systems. AI Defense records each testing action, allowing audit trails and repeatable results that can inform follow-up attack loops.

The framework is designed to restrict how the model is used. Customers interact through AI Defense's structured interface and do not receive open-ended prompt access. Targets must be registered, owned and authorized by the customer, while each engagement requires authentication and is cryptographically tied to a named enterprise operator. Cisco also says engagements use fixed objectives and time-bound sessions that can be halted on demand, with product-level controls working alongside program-level safeguards and monitoring.

"Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production," said Michael Moore, Cybersecurity Lead at Anthropic. "By bringing Claude Mythos to Cisco AI Defense, Cisco can help security teams red team their agents with advanced reasoning that plans tests and generates attack ideas for each system." Adaptive red teaming with Claude Mythos is coming soon for select enterprises.

Splunk tools connect agent spending with business value

Cisco is also expanding Splunk Agent Observability with tools intended to give organizations a real-time view of agent cost, quality and business impact. Its new Tokenomics capability uses usage data from Amazon Bedrock and Amazon CloudWatch to pair each agent's cost with evaluations of its output quality and impact.

Cisco describes Tokenomics as cost governance that ties AI spending to output quality. The feature extends token-spend attribution launched at .conf26, which tracks costs across AI agents and coding tools such as Claude Code, Codex and Cursor. Tokenomics will be available in private preview in December, with general availability in AWS Marketplace early 2027.

Splunk Agent Observability is also adding Eval-G1 evaluation models. Cisco says these custom small language models can turn agentic traces and expert feedback into evaluations and guardrails at up to 98% lower cost than a commercial LLM, with response times 2.5x faster than traditional LLMs. The Evaluation Tuner will let teams use traces and subject matter expert feedback to fine-tune evaluator models that enforce quality standards and steer agents at machine speed. The evaluation models and Evaluation Tuner are generally available starting this month.

Cisco IQ brings infrastructure exposure into security workflows

Cisco is extending real-time intelligence from Cisco IQ into enterprise security environments, open agentic protocols and automated lifecycle workflows. Cisco IQ has close to 17,000 customers across more than 22 million devices, according to the company.

Through Cisco Data Fabric powered by the Splunk Platform, Cisco IQ vulnerability, lifecycle and configuration data can be ingested into the Splunk Platform through open APIs. This allows security operations teams and AI agents to correlate live threat detections with the underlying network exposure in Splunk Enterprise Security.

New Model Context Protocol and ServiceNow connectors provide infrastructure context to supported AI agents and IT service management platforms. They can also translate exposure findings into asset-linked ServiceNow problem records, helping coordinate remediation without manual data reconciliation.

Cisco's AI-Powered Resilient Infrastructure Playbook surfaces critical lifecycle vulnerabilities, including personalized alerts for known defects and quantum-safe cryptographic readiness. Cisco said its partners and Professional Services teams can help customers scope modernization roadmaps, prioritize remediation and put the capabilities into practice.

Cisco frames the announcements as a continuous trust loop

The announcements reflect Cisco's effort to connect security testing, operational visibility and remediation in one workflow as enterprises deploy more AI agents. Cisco President and Chief Product Officer Jeetu Patel said, "You cannot scale what you cannot secure, govern, or observe." He described the combined capabilities as a continuous trust loop that protects agents from compromise while measuring the value of token spending.

Cisco cited a global Splunk research report from last month saying that 81% of ITOps and engineering professionals report increased cooperation between security and observability teams. The company said its AI Defense, Splunk and Cisco IQ updates are intended to support that cooperation by linking adversarial testing with agent quality, costs and infrastructure risk.

For users, the practical focus is earlier testing of AI agents, more detailed tracking of their operating costs and faster movement from an identified exposure to a remediation workflow. Cisco said AI Defense has helped hundreds of customers identify critical flaws in AI models, applications and agents since its launch in January 2025. The company is presenting the combined capabilities as infrastructure for securing, governing and observing increasingly capable enterprise AI deployments.