Cisco Adds Anthropic's Claude Mythos to AI Defense and Launches Splunk Agent Observability

Cisco said on November 9, 2026 that it is adding Anthropic's Claude Mythos to AI Defense for red teaming AI applications and agents, alongside new Splunk Agent Observability and Cisco IQ capabilities. The announcement was made at Cisco Live APJC in Melbourne, Australia, PR Newswire reported.

How Claude Mythos Stress-Tests AI Agents

Cisco's adaptive red teaming lets security teams build customized, multi-step attacks on target systems to uncover specific risks. Claude Mythos adds advanced reasoning that plans tests and translates results into attack ideas for each system. Features include realistic adversarial ideation that generates multi-step, contextual attack paths, and audit trails that record each testing action so results can inform follow-up attack loops.

Cisco said customers interact only through AI Defense's structured interface, with no open-ended prompt access. Engagements run only against targets explicitly registered, owned, and authorized for testing by the enterprise customer, and each requires authentication tied to a named enterprise operator. Sessions are time-bound and can be halted on demand.

"Enterprises are increasingly building AI agents into their core operations and want to test those agents thoroughly before putting them into production," said Michael Moore, Cybersecurity Lead at Anthropic. "By bringing Claude Mythos to Cisco AI Defense, Cisco can help security teams red team their agents with advanced reasoning that plans tests and generates attack ideas for each system."

Cisco launched AI Defense in January 2025 and said it has helped hundreds of customers identify critical flaws in AI models, applications, and agents before they reach production. Adaptive red teaming with Claude Mythos is coming soon for select enterprises.

Tokenomics Ties Agent Spend to Output Quality

Cisco is adding Tokenomics to Splunk Agent Observability, a cost governance tool that ties AI spend to output quality. Using usage data from Amazon Bedrock and Amazon CloudWatch, it pairs each agent's cost with evaluations that grade the quality and impact of its work. This extends the token-spend attribution launched at .conf26, which tracks costs across AI agents and coding tools such as Claude Code, Codex, and Cursor.

Splunk Agent Observability also adds Eval-G1 evaluation models, which turn agentic traces and expert feedback into custom small language models that execute evals and guardrails at up to 98% lower cost than a commercial LLM. Cisco said these models deliver evaluation response times 2.5x faster than traditional LLMs. The Evaluation Tuner lets teams turn agentic traces and subject matter expert feedback into fine-tuned evaluator models.

Tokenomics will be available in private preview in December, with general availability in AWS Marketplace early 2027. The evaluation models and the evaluation tuner are generally available starting this month.

Cisco IQ Feeds Exposure Data Into Splunk

Cisco IQ, which has close to 17,000 customers across more than 22 million devices, now extends real-time intelligence into enterprise security environments. A Cisco Data Fabric integration ingests Cisco IQ vulnerability, lifecycle, and configuration data directly into Splunk Platform via open APIs, letting SecOps teams and AI agents correlate live threat detections with underlying network exposure in Splunk Enterprise Security.

Model Context Protocol and ServiceNow connectors provide structured infrastructure context to supported AI agents and enterprise IT Service Management platforms, translating exposure findings into asset-linked ServiceNow problem records. An AI-powered Resilient Infrastructure Playbook surfaces critical lifecycle vulnerabilities, including personalized alerts for known defects and quantum-safe cryptographic readiness.

"AI is shrinking the time organizations have to respond to threats, and knowing where you're exposed only matters if you can act on it," said Liz Centoni, Cisco EVP and Chief Customer Experience Officer. "Bringing Cisco IQ vulnerability insights into Cisco Data Fabric powered by the Splunk Platform gives analysts that context in the middle of an investigation, so they can decide what to do next."

Cisco's Splunk Platform and AI Push

Cisco acquired Splunk for $28 billion in a deal that closed in March 2024, integrating SIEM, observability, and SOAR into Cisco's security portfolio and anchoring its AgenticOps platform, according to akta.pro company records. Cisco launched Cisco Cloud Control and AI Canvas at Cisco Live 2026 Las Vegas, unifying networking, security, compute, observability, and collaboration under a single AgenticOps platform with multiplayer human and agent workflows.

Cisco reported $15.8 billion in revenue for Q3 FY2026, up 12% year over year, and raised full-year FY26 revenue guidance to $62.8 billion to $63 billion. The company also raised its hyperscaler AI orders guidance to $9 billion for fiscal year 2026.

Earlier Cisco Security Announcements

On November 3, 2026, Cisco and OpenAI detailed machine-speed enterprise cyber defenses, combining network intelligence with reasoning models to improve enterprise security and detect threats more adaptively, Blockchain News reported. That same day, CRN reported that Cisco is urging partners to lead with resilient infrastructure services, promoting Cisco IQ and Cloud Control as AI-powered tools to identify risks and modernize customer environments.

On November 5, 2026, iTWire reported that Splunk, via Cisco, is expanding AI observability with agent evaluation, token spending controls, and network intelligence. A bank case study cited by iTWire shows Galileo's small language models raised an AI assistant's accuracy from 90% to 95%.