Cisco Brings Anthropic's Claude Mythos Into AI Defense for Agent Red Teaming

Cisco has added support for Anthropic's Claude Mythos to its AI Defense package, aiming to help enterprise customers find vulnerabilities in AI agents before attackers can exploit them. The companies frame it as a way to put frontier reasoning capabilities in the hands of defenders under controlled, audited conditions — rather than keeping them locked away entirely.

The deal matters because AI agents are getting more responsibility inside enterprises. As agents gain access to databases, applications, credentials, and business workflows, they create a new attack surface that spans the whole organization, according to a Cisco blog post by Amy Chang, head of AI threat intelligence and security research, and Vikram Varakantam, senior director of product management, AI software and platform.

How does Claude Mythos fit into AI Defense?

The short version: it powers the reasoning engine that plans attacks against your own systems, before anyone else does.

"Bringing Claude Mythos to AI Defense augments the adaptive red teaming engine where the attacker's reasoning matters most," Chang and Varakantam wrote. "As the engine works to understand a target system and plan tests, the model's reasoning produces attack ideas. When those ideas become concrete payloads, the benefit is sharper still: the capabilities of Claude Mythos are offered under safeguards built for authorized testing."

Claude Mythos is optimized for cybersecurity work. It can reason through an attack, analyze how an AI agent is configured, and determine what resources that agent can reach. Cisco says security teams can use it to build attack strategies tailored to their own environment, spot specific weaknesses, and predict how endpoints or other systems will respond to a given problem.

The payoff, according to Cisco, is finding attack chains that ordinary testing leaves behind. With Mythos, customers could discover sophisticated, multi-step attack paths that conventional testing might miss — and evaluate agents before those agents go live in the enterprise. That last point is the practical stake: testing before deployment, not after an incident.

What controls keep an attack model on a leash?

This is the part most readers will care about. Cisco is deploying a model designed to think like an attacker, so the guardrails deserve scrutiny.

The model does not run free. "The [Mythos] model sits inside AI Defense with a fixed job, a registered target, and objectives defined by the human user," Chang and Varakantam wrote. "While customers do not get an open interface to Claude Mythos, they get to inform the target and objective, and our agentic red teaming framework conducts the engagement within those bounds."

The two Cisco executives framed that design choice as a preview of how frontier AI capabilities might be distributed for security work going forward. "We regard this as an early instance of a broader shift, in which the frontier capabilities most relevant to security are made available to defenders under verified, controlled access rather than withheld from everyone," they wrote.

The containment stack has multiple layers, and Cisco laid them out:

• The deployment operates only against the target a customer has registered and is authorized to test.
• It runs with a fixed job and human-defined objectives.
• There is no open interface a customer could use to prompt it freely.
• Its activity stays confined to the authorized target, not the wider internet.
• Every action is attributable to a named operator and recorded for audit.

"Cisco designed this deployment to operate against only the target a customer has registered and is authorized to test; it runs with a fixed job and human-defined objectives, has no open interface a customer could use to prompt it freely, and its activity is confined to the authorized target rather than the wider internet," Chang and Varakantam wrote. "Every action it takes is attributable to a named operator and recorded for audit. These product-level controls sit alongside the program-level safeguards and monitoring, so containment does not rest on any single layer."

In plain terms: the model can't be repurposed, can't wander off the registered target, and everything it does leaves a paper trail with a name attached.

What did Anthropic say about the partnership?

Anthropic put its own name behind the integration. Michael Moore, cybersecurity lead at Anthropic, framed it around a shift he says is already underway in how enterprises ship agents.

"Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production," Moore said. "By bringing Claude Mythos to Cisco AI Defense, Cisco can help security teams red team their agents with advanced reasoning that plans tests and generates attack ideas for each system."

That quote cuts to the commercial logic on both sides. Anthropic gets its security-tuned model embedded in a major enterprise security platform, and Cisco gets a differentiator for AI Defense at a moment when agentic AI is becoming standard enterprise infrastructure.

What is already in Cisco's AI Defense?

AI Defense is not a new product, and Mythos slots into an existing four-part structure. The package protects enterprise customers who are developing AI applications across models and cloud services, and it consists of:

• AI Access — gives visibility into who wants or has use of an AI application, then controls access to enforce data-loss prevention and mitigate potential threats.
• AI Cloud Visibility — uncovers AI assets including custom-built AI applications, offering a single-pane-of-glass view of AI inventory.
• AI Model & Application Validation — evaluates models and applications before and during deployment.
• AI Runtime Protection — defends AI workloads in operation.

Standard and adaptive red teaming is already available in AI Defense today. The Claude Mythos-powered adaptive red teaming is not. It is "coming soon for select enterprises," with broader availability planned for qualified customers on a when-and-if-available basis, Chang and Varakantam stated. Cisco has not published a general release date, which suggests a deliberately staged rollout for a capability this sensitive.

What else did Cisco announce? Splunk agent observability

In a related announcement, Splunk by Cisco said it is adding new Splunk Agent observability capabilities for customers running on Amazon Web Services. The feature lets them centrally measure agent cost and quality — a response to the growing problem of agents whose spend nobody can account for.

The core of it is an enhanced Tokenomics capability aimed at cost governance, tying AI spend to output quality. It offers a unified way to monitor each agent by its cost and business results, Cisco stated in a blog post.

"Tokenomics pairs the cost of every agent with evaluations that grade the quality and impact of the work, giving organizations a single view of AI ROI," Cisco stated. "The solution leverages usage data from Amazon Bedrock and Amazon CloudWatch, then combines those technical metrics with customer-defined business KPIs like NPS (Net Promoter Score) or cost-per-claim to produce ROI reports executives can act on."

That approach is notable because it merges infrastructure telemetry with business metrics. Rather than reporting token counts or inference costs in isolation, Splunk connects them to outcomes executives already track — making the agent ROI question answerable in the language of the business.

Why this pairing signals where agent security is heading

The two announcements fit together. One gives enterprises a way to break their agents before attackers do; the other gives them a way to prove those agents are worth the money. Both assume the same premise: AI agents are moving into core operations, and the tooling to secure and measure them has to catch up.

The Cisco-Anthropic integration also sets a template worth watching: a frontier model released not through a public API but through a security product, with fixed jobs, registered targets, and audit logs. If that model of "verified, controlled access" spreads, it could become the standard way dangerous-but-useful AI capabilities reach enterprise defenders.