Cisco adds Claude Mythos to controlled AI red teaming

Cisco announced on November 9, 2026 that it will add Anthropic’s Claude Mythos to AI Defense’s adaptive red-teaming framework for controlled testing of AI applications and agents. Cisco also says its Eval-G1 evaluation models can run evaluations and guardrails at up to 98% lower cost than a commercial large language model (LLM).

The company reports evaluation responses 2.5 times faster than traditional LLM judges. At Cisco Live APJC in Melbourne, Cisco also presented Splunk agent-observability updates and Cisco IQ integrations. Cisco reports that IQ serves close to 17,000 customers across more than 22 million connected devices, supplying asset, coverage and advisory context.

The announcement connects pre-production attack testing with agent-cost evaluation and infrastructure remediation. Cisco positions that combination as an operational path from finding a weakness to measuring agent output and assigning repair work. The caveat is timing: several parts remain unreleased, so Cisco describes a staged package rather than a completed workflow.

What will Claude Mythos actually do?

Customers will not be able to prompt Claude Mythos freely. According to Cisco, the model will receive a fixed job, a registered target and human-defined objectives. It will supply reasoning for test planning and attack ideation, while AI Defense conducts the engagement.

That restriction separates a bounded testing component from an autonomous attacker with broad access. It also means the model’s usefulness depends on customers defining targets and objectives carefully. Cisco says the reasoning can inform the test plan without granting unrestricted execution.

Takeaway: Mythos helps design authorized attacks; it does not receive an open-ended mandate to search the internet.

How does adaptive testing differ from standard testing?

Red teaming, or security testing that simulates hostile use, already has two forms inside AI Defense. Standard mode checks common risks such as prompt injection (instructions that hijack an AI system), jailbreaks (attempts to bypass safeguards), sensitive-data exposure and harmful content. Cisco says those checks span thousands of categories, content types and adversarial techniques.

Adaptive mode starts with customer criteria written in plain language. It then analyzes the target, develops tailored attacks and uses responses to refine its approach or change tactics. Cisco says the process reports findings, recommends follow-up actions and can support repeatable attack loops.

Takeaway: Standard testing searches for known failure patterns; adaptive testing changes its attack after seeing the target respond.

How does Cisco control access to red teaming?

Claude Mythos will run only against targets the enterprise customer explicitly registers, owns and authorizes for testing. Cisco says it cannot scan arbitrary internet infrastructure. Every engagement requires authentication and is cryptographically tied to a named operator.

Sessions have expiration limits and can be halted. Cisco says every action is recorded for audit, and results can feed repeatable follow-up attack loops. Together, those controls provide accountability for authorized testing, although the announcement provides no independent audit of the enforcement mechanism.

Standard and adaptive red teaming are already available in AI Defense. The Claude Mythos version is “coming soon” for select enterprises, and Cisco has no committed date for broader access to qualified customers. Cisco also says timing, scope and regional availability may change.

Since AI Defense launched in January 2025, Cisco says the product has helped hundreds of customers identify flaws in models, applications and agents before production. The announcement names no participating Mythos customers, selection criteria or independent validation results. It therefore offers no independent confirmation of the new controls.

Takeaway: Cisco has described strong authorization and audit boundaries, but the Mythos enforcement claims remain vendor-reported.

Can agent evaluation become cheaper and faster?

Eval-G1 uses custom small language models, meaning compact models specialized for evaluation rather than broad conversational work. These models run evaluations and guardrails, which are automated checks that steer or block poor outputs. Cisco’s separate evaluation tuner turns agentic traces, or step-by-step execution records, and subject-matter-expert feedback into fine-tuned evaluators.

The resulting evaluators enforce quality standards and can steer or block inaccurate agent behavior. Cisco says Enhanced Tokenomics, its cost-attribution feature for agents, will use Amazon Bedrock and Amazon CloudWatch usage data to pair each agent’s spend with evaluations of output quality and impact.

Customers can combine those technical metrics with Net Promoter Score, a customer-satisfaction measure, or cost per claim. Cisco says this extends existing token-spend attribution across AI agents and coding tools including Claude Code, Codex and Cursor.

Cisco makes Eval-G1 and the evaluation tuner generally available in November 2026. It schedules Tokenomics for private preview in December 2026, followed by general availability through AWS Marketplace in early 2027. The announcement gives no list prices, benchmark baselines or independent validation for the 98% cost and 2.5-times speed claims.

Takeaway: The headline efficiency figures look useful, but Cisco does not disclose enough test detail to judge their reach.

How does Cisco IQ connect exposure to remediation?

Another part of the announcement concerns what happens after a security team finds infrastructure risk. Cisco reports that IQ serves close to 17,000 customers across more than 22 million connected devices. It supplies asset, coverage and advisory context for those deployments.

The IQ remediation workflow sends vulnerability, lifecycle and configuration data through Cisco Data Fabric into Splunk Platform through open APIs. Security teams and AI agents can then correlate live detections in Splunk Enterprise Security with underlying network exposure. This links recorded weaknesses to the systems that may increase their consequence.

Model Context Protocol and ServiceNow connectors add structured infrastructure context to supported agents and IT-service workflows. Cisco says exposure findings can become asset-linked ServiceNow problem records without manual data reconciliation, removing a repetitive handoff between identification and ticket creation. Cisco cautions that “finding an exposure does not establish that an attacker exploited it.”

The workflow adds investigation context and coordinates remediation; it does not treat each finding as a confirmed breach. That limitation matters because infrastructure exposure can describe risk without proving hostile activity. Cisco uses the same distinction in its broader resilience package.

Takeaway: IQ can connect evidence to remediation, but Cisco deliberately stops short of calling exposure a compromise.

What does the resilience playbook add?

The AI-Powered Resilient Infrastructure Playbook adds a wider modernization layer. Cisco says it surfaces critical lifecycle vulnerabilities, creates personalized alerts for known defects and shows quantum-safe cryptographic readiness, meaning readiness for cryptography intended to resist quantum attacks. Security teams and certified partners can use those signals to prioritize modernization.

The announcement does not explain how Cisco scores readiness or which cryptographic methods it considers quantum-safe. It also gives no separate availability date for the playbook. The practical claim is narrower than automated remediation: use lifecycle and exposure context to decide what to fix first.

Takeaway: The playbook helps prioritize maintenance work; it does not prove that attackers used a flaw.

What can customers use now?

Availability remains fragmented across the package. Cisco already offers standard and adaptive AI Defense red teaming, while Eval-G1 and the evaluation tuner become generally available in November 2026. Cisco still lists Claude Mythos red teaming only for select enterprises, with no broader release date.

Enhanced Tokenomics has the longest stated runway: private preview in December 2026, then AWS Marketplace general availability in early 2027. Cisco does not give a separate rollout date for the IQ remediation workflow or resilience playbook in the announcement. Its end-to-end story therefore combines available components with two forthcoming releases.

Before the package works as described, customers must register authorized targets, define objectives and retain the resulting audit trails. They must also determine whether the reported cost and speed gains survive real workloads. Cisco summarizes the promised boundary as “attack generation stays within authorized jobs.”

Takeaway: December’s Tokenomics preview and the uncommitted Mythos rollout will show whether Cisco’s pieces work together as advertised.