Cisco AI Defense adds Claude Mythos red teaming to stress-test enterprise AI agents

The pitch is simple: before your AI agent goes live, let another frontier model try to break it. Cisco’s version of that idea, announced Monday at Cisco Live APJC in Melbourne, puts Anthropic’s Claude Mythos inside AI Defense — not as a chatbot security teams can prompt freely, but as the reasoning engine behind a contained, auditable attack simulation.

Mythos plans the attacks. AI Defense runs them. And a second set of announcements — Splunk cost tracking and Cisco IQ exposure data — closes the loop from finding a weakness to fixing it and proving the spend was worth it.

How the red teaming works, step by step#

Cisco’s adaptive red teaming already existed: security teams could build customized, multi-step attacks against a target system. Mythos slots into the step where attacker reasoning matters most — planning what to try, and turning results into the next attack idea. Here is the sequence:

1. Register the target. A security team picks an AI application or agent it owns, registers it as an authorized target, and defines the test objectives — what the agent may touch, and what counts as a failure. Mythos cannot scan arbitrary internet infrastructure; it works only against targets the customer explicitly owns and authorized.
2. Mythos plans the attack. The model designs multi-step, contextual attack paths — chains of prompts and tool calls meant to surface subtle vulnerabilities across a complex system, rather than single-shot jailbreaks.
3. AI Defense runs the engagement. The test runs as a fixed job with human-defined objectives and time-bound sessions that can be halted on demand. Customers interact only through AI Defense’s structured interface — there is no open-ended prompt access to Mythos itself.
4. Every action is logged. AI Defense records each testing action for audit, and results carry over into follow-up attack loops, so the next round of tests builds on what the last one found.

Take a customer-service agent with access to order records and a refund tool — a typical enterprise target, used here as an illustration. A single prompt asking for a refund is easy to handle. A multi-step attack might first get the agent to reveal another customer’s order details, then use those details to authorize a refund to a different account. That chain — reconnaissance, escalation, extraction — is the kind of sequence Mythos is meant to design, and the kind a one-shot test usually misses.

The four guardrails#

The guardrails are the point. Mythos is a model built for offensive security work — Anthropic limits it to vetted cybersecurity and life-sciences users under its Project Glasswing program — so Cisco’s containment is what makes it deployable inside an enterprise at all.

The announcement: what Cisco actually launched#

The release, issued Monday from Melbourne, bundles three pieces under one theme Cisco calls a “continuous trust loop”: test the agent, measure what it costs, and fix what the tests find. “You cannot scale what you cannot secure, govern, or observe,” said Cisco President and Chief Product Officer Jeetu Patel. Anthropic’s Cybersecurity Lead, Michael Moore, put the use case plainly: “Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production.”

Mythos launched the same day as part of Anthropic’s Claude 5.2 family — the restricted sibling of the flagship model, reserved for vetted defenders. Cisco is among the first AI security products to build on it. Chainguard is already using Mythos for vulnerability hunting, a sign the model’s offensive-security role is becoming a pattern, not a one-off.

The other half of the loop: cost and exposure#

The Splunk half of the announcement is the part enterprises can use immediately. Tokenomics, a cost-governance feature, ties an agent’s spend to the quality of its output: using usage data from Amazon Bedrock and Amazon CloudWatch, it pairs each agent’s cost with evaluations grading the quality and impact of its work, giving organizations a single view of AI return on investment. It extends token-spend attribution Splunk launched at .conf26, which tracks costs across AI agents and coding tools such as Claude Code, Codex, and Cursor.

The evaluations themselves got cheaper and faster. Splunk’s Eval-G1 models turn agentic traces and expert feedback into custom small language models that run evals and guardrails at up to 98% lower cost than a commercial LLM, with response times 2.5x faster. The Evaluation Tuner lets teams turn their own traces and expert feedback into fine-tuned evaluator models.

Cisco IQ is being wired into the same loop. The product covers close to 17,000 customers across more than 22 million devices, and its vulnerability, lifecycle, and configuration data now flows into the Splunk Platform through Cisco Data Fabric. MCP and ServiceNow connectors translate exposure findings into asset-linked ServiceNow problem records automatically. The backdrop, from Splunk research last month: 81% of ITOps and engineering professionals cite increased cooperation between security and observability teams.

Why this matters now#

AI Defense launched in January 2025, and Cisco says it has helped hundreds of customers identify critical flaws in AI models, applications, and agents before they reached production. The Mythos upgrade lands as agents move from demos into core operations — with tool access and sensitive data attached — and as AI lowers the barrier to entry for attackers. “AI is shrinking the time organizations have to respond to threats,” said Liz Centoni, Cisco’s EVP and Chief Customer Experience Officer, “and knowing where you’re exposed only matters if you can act on it.”

The honest caveat is availability. Nothing in the Mythos half of this announcement can be bought today: it is “coming soon” for select enterprises, with no pricing, no regions, and no committed date, and broader availability is planned on a when-and-if basis. The Splunk pieces are real and dated — evaluation models now, Tokenomics in December — but the headline capability is a promise with guardrails, not a product on a shelf. Watch whether the first select-enterprise deployments surface before Tokenomics reaches AWS Marketplace in early 2027; if the security half lags the cost half, Cisco’s trust loop has one side missing.

What to watch#

Which enterprises get the first Mythos red-teaming deployments, and what they find — the first public results will say more about the capability than any launch copy. Whether Tokenomics’ December private preview lands on schedule, and whether the AWS Marketplace launch in early 2027 follows. And whether Cisco’s containment model becomes the template for how other vendors ship offensive-security models: registered targets, named operators, revocable jobs. If it does, the guardrails matter as much as the model.

Sources: Cisco, “Cisco Unveils Frontier AI Red Teaming and Agent Observability to Secure the Agentic Enterprise” (PRNewswire, November 9, 2026), here; Cisco, “Cisco AI Defense to Add Anthropic’s Claude Mythos for AI Red Teaming” (November 9, 2026), here; Unite.ai, “Cisco to Add Claude Mythos to AI Defense for Controlled Red Teaming” (November 9, 2026), here.