Cisco is adding Claude Mythos, Anthropic 's most capable AI model, to its AI Defense platform. Enterprises can use it to attack their own AI agents before someone else does. The company announced the move at Cisco Live APJC in Melbourne on Tuesday, along with new Splunk tools that track what AI agents cost and whether that spend pays off.




Mythos will sit inside AI Defense's adaptive red teaming framework, which security teams use to build custom, multi-step attacks on AI models , apps and agents. Cisco says the model will plan the tests that matter, map attack paths across complex systems and turn each round of results into fresh attack ideas. Every action is logged for audit.




"You cannot scale what you cannot secure, govern, or observe," said Cisco President and Chief Product Officer Jeetu Patel.



Cisco is putting tight limits on how customers use Claude Mythos




Customers won't get open-ended prompt access. They work only through AI Defense's structured interface, and tests run only against systems they have registered, own and authorised. Each engagement is cryptographically tied to a named operator and follows objectives set by a human. It also runs in a time-bound session that can be halted on demand.




The caution is deliberate. Cisco notes that frontier models are skilled at crafting attack strategies, and that the same ability is lowering the barrier for attackers.




Michael Moore, Cybersecurity Lead at Anthropic, said enterprises want to test their agents thoroughly before putting them into production.



Splunk wants companies to see what every AI agent costs and delivers




The new Tokenomics feature pulls usage data from Amazon Bedrock and Amazon CloudWatch and pairs each agent's cost with graded evaluations of its work. It builds on token-spend tracking introduced at .conf26, which follows spending across coding tools such as Claude Code, Codex and Cursor.




Splunk is also offering Eval-G1, small custom models that run evaluations and guardrails at up to 98% lower cost than a commercial LLM, and they respond 2.5 times faster. An Evaluation Tuner lets teams turn agent traces and expert feedback into their own evaluator models.




Cisco IQ, used by close to 17,000 customers across more than 22 million devices, will now feed vulnerability data into Splunk and turn exposure findings into ServiceNow problem records.




Mythos-powered red teaming arrives soon for select enterprises. Tokenomics enters private preview in December and reaches AWS Marketplace in early 2027. The evaluation models and tuner are available this month.