Cisco adds Claude Mythos to AI Defense red teaming platform

Claude Mythos brings advanced reasoning to red teaming

Claude Mythos will augment Cisco AI Defense's adaptive red teaming framework with what Cisco describes as advanced adversarial reasoning. The system is intended to plan relevant tests and translate their results into attack ideas for individual AI systems.

Cisco said the framework can generate realistic, contextual, multi-step attack paths to help identify subtle vulnerabilities across complex architectures. It also records each testing action, allowing teams to audit engagements and carry results into follow-up attack loops.

Customers interact with Claude Mythos through AI Defense's structured interface, rather than receiving open-ended prompt access. Cisco said the tool is designed to operate only against targets that enterprises have explicitly registered, own and authorized for testing. Each engagement requires authentication and is cryptographically tied to a named enterprise operator. Jobs have fixed objectives, time-bound sessions and the ability to be halted on demand.

“Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production,” said Michael Moore, Cybersecurity Lead at Anthropic. He said bringing Claude Mythos to Cisco AI Defense can help security teams red team agents with reasoning that plans tests and generates attack ideas for each system.

Observability links agent costs to quality

Cisco is also expanding Splunk Agent Observability with Tokenomics, a cost governance capability that connects AI spending to output quality. Using usage data from Amazon Bedrock and Amazon CloudWatch, it pairs each agent's cost with evaluations of the quality and impact of its work, giving organizations a single view of AI return on investment.

Tokenomics extends token-spend attribution launched at .conf26, which tracks costs across AI agents and coding tools such as Claude Code, Codex and Cursor. Cisco said Tokenomics will be available in private preview in December, with general availability in AWS Marketplace early 2027.

Splunk Agent Observability also supports Eval-G1 evaluation models. Cisco said these custom small language models can turn agentic traces and expert feedback into evaluations and guardrails at up to 98% lower cost than a commercial large language model. The models deliver evaluation response times 2.5x faster than traditional large language models, according to Cisco.

The Evaluation Tuner allows teams to turn agentic traces and subject matter expert feedback into fine-tuned evaluator models that enforce quality standards and steer agents. The evaluation models and Evaluation Tuner are generally available starting this month.

Cisco IQ connects exposure data with remediation

Cisco is extending Cisco IQ intelligence into enterprise security environments, open agentic protocols and automated lifecycle workflows. Cisco IQ has close to 17,000 customers across more than 22 million devices, according to the company.

A Cisco Data Fabric integration will ingest Cisco IQ vulnerability, lifecycle and configuration data into the Splunk Platform through open APIs. Security operations teams and AI agents can then correlate live threat detections with underlying network exposure in Splunk Enterprise Security.

New Model Context Protocol and ServiceNow connectors provide infrastructure context to supported AI agents and IT service management platforms. The connectors can translate exposure findings into asset-linked ServiceNow problem records, reducing the need for manual data reconciliation.

Cisco also introduced an AI-Powered Resilient Infrastructure Playbook. It surfaces critical lifecycle vulnerabilities, including personalized alerts for known defects and information about quantum-safe cryptographic readiness, to help teams and certified partners scope and prioritize modernization roadmaps.

Cisco frames the tools as a continuous trust loop

Cisco said the updates are intended to help enterprises secure, govern and observe increasingly capable AI agents through one operating loop. The company launched AI Defense in January 2025 and said it has helped hundreds of customers identify critical flaws in AI models, applications and agents before production.

“You cannot scale what you cannot secure, govern, or observe,” said Cisco President and Chief Product Officer Jeetu Patel. He described the combination of runtime protections and agent quality controls as a continuous trust loop that protects agents from compromise while connecting token spending to measurable business value.

The approach links three concerns that become more difficult as agents connect to tools and sensitive data: testing for attacks, assessing whether agents deliver quality results at a reasonable cost, and identifying the infrastructure exposures that could require remediation. Adaptive red teaming with Claude Mythos is coming soon for select enterprises, while the observability and Cisco IQ updates provide paths for measuring agent performance and acting on related infrastructure risk.