Cisco adds Claude Mythos to AI Defense for agent security testing

Claude Mythos brings advanced reasoning to AI Defense

Claude Mythos will augment Cisco AI Defense's adaptive red teaming framework, which lets security teams build customized, multi-step attacks against target systems. According to Cisco, the Anthropic model will plan tests and translate results into attack ideas for individual systems, helping teams identify subtle vulnerabilities across complex architectures.

The features include realistic adversarial ideation, secure and contained access, and audit trails with repeatable results. Customers interact with Claude Mythos through AI Defense's structured interface and do not receive open-ended prompt access.

Cisco said the system is restricted to targets that an enterprise has registered, owns and authorized for testing. Each engagement requires authentication and is cryptographically tied to a named operator. Jobs have fixed objectives and time-bound sessions that can be halted by the user, while product controls operate alongside program-level safeguards and monitoring.

“By bringing Claude Mythos to Cisco AI Defense, Cisco can help security teams red team their agents with advanced reasoning that plans tests and generates attack ideas for each system,” said Michael Moore, Cybersecurity Lead at Anthropic.

Observability connects agent costs with business value

Cisco's Splunk Agent Observability enhancements are intended to give organizations a real-time view of AI agent cost, performance and quality. Its Tokenomics capability uses usage data from Amazon Bedrock and Amazon CloudWatch to pair each agent's cost with evaluations of its work, creating a single view of AI return on investment, according to Cisco.

Tokenomics extends token-spend attribution launched at .conf26, which tracks costs across AI agents and coding tools including Claude Code, Codex and Cursor. It will be available in private preview in December, with general availability in AWS Marketplace early 2027.

Splunk Agent Observability's Eval-G1 evaluation models can turn agentic traces and expert feedback into custom small language models for evaluations and guardrails. Cisco says they can run at up to 98% lower cost than a commercial LLM and provide evaluation response times 2.5x faster than traditional LLMs. The evaluation models and Evaluation Tuner are generally available starting this month.

Cisco IQ links exposure data to remediation

Cisco is also extending Cisco IQ intelligence into security environments, open agentic protocols and automated lifecycle workflows. Cisco IQ has close to 17,000 customers across more than 22 million devices, according to the company.

Through Cisco Data Fabric Integration, Cisco IQ vulnerability, lifecycle and configuration data can be ingested into the Splunk Platform through open APIs. Security teams and AI agents can then correlate live threat detections with underlying network exposure in Splunk Enterprise Security.

New Model Context Protocol and ServiceNow connectors provide infrastructure context to supported AI agents and IT service management platforms. They can also translate exposure findings into asset-linked ServiceNow problem records. Cisco's AI-Powered Resilient Infrastructure Playbook surfaces lifecycle vulnerabilities, personalized alerts for known defects and quantum-safe cryptographic readiness.

Together, the updates are intended to help enterprises test agents before production, monitor their costs and quality, and connect detected risks to infrastructure remediation. “You cannot scale what you cannot secure, govern, or observe,” said Cisco President and Chief Product Officer Jeetu Patel.