Cisco will use Anthropic's Claude Mythos to test AI tools for security holes

Cisco plans to use Anthropic's AI model, Claude Mythos, to attack a company's own AI tools on purpose, so weak spots get found before real criminals find them. The company announced it at its Cisco Live APJC event in Melbourne, Australia. The feature will sit inside Cisco AI Defense, Cisco's security product for AI.

What changed

AI agents are programs that act on their own, and more of them can now reach company systems and sensitive data. Cisco wants to test them the way an attacker would. Claude Mythos will run multi-step tests that closely copy real attacks on AI applications and agents, then report potential vulnerabilities.

Cisco set limits on the testing. These are the safeguards it described:

• It works only on systems a company owns and has approved for testing.
• Every test needs administrator authentication and leaves an audit trail.
• Scans of arbitrary internet infrastructure are restricted.
• Tests can be halted when needed.

Tracking cost and quality

Cisco is also adding tools to show what AI agents cost and how well they work. Tokenomics, part of Splunk Agent Observability, compares token spending by agent with the quality of the work. Tokens are the small chunks of text that AI services count and bill by. Companies can use it to gauge return on investment for agents and coding tools such as Claude Code, Codex and Cursor.

For quality checks, Cisco is offering Eval-G1, a small AI model built on agent run logs and expert feedback. Cisco says it can assess agents and apply guardrails at up to 98% lower cost than commercial large models, and runs 2.5 times faster. An Evaluation Tuner lets companies adjust it to their own quality standards.

Security data in one place

Cisco is also linking Cisco IQ with Splunk. Cisco IQ data on vulnerabilities, product life cycles and device settings will flow into Splunk, so security teams can view threats next to weaknesses in their networks. A ServiceNow connector will tie findings to IT asset and incident records and automate response steps. Cisco IQ currently manages more than 16,000 customer organizations and about 20 million devices.

What happens next

Timing differs by piece. Eval-G1 and the Evaluation Tuner become generally available starting in November. Tokenomics enters private preview in December and reaches the AWS Marketplace in early 2027. Claude Mythos red-team testing will roll out soon to select enterprise customers. The material does not give prices for any of these tools.

Jeetu Patel, Cisco's president and chief product officer, said that without security, governance and observability, AI cannot scale.