AI Agent Security: Cisco Adds Claude Mythos to Controlled Red-Team Testing

Nov 14, 2026

AI agent security is becoming a practical concern for companies that connect software agents to tools, data and business systems. Cisco says it plans to add Anthropic’s Claude Mythos to its AI Defense service for controlled red-team testing of customer AI applications and agents. The November announcement also adds new Splunk observability features aimed at tracking agent quality and cost.

The announcement matters for two reasons. It places a frontier model inside a defensive testing workflow, and it treats monitoring an agent’s behaviour and spending as part of security operations. Cisco says the Mythos integration will be available soon to select enterprises. It does not give customers open-ended access to the model.

AI agent security monitoring in an enterprise control room — Teams need visibility into what agents do, which tools they use and where they access data.

AI agent security through controlled testing

Red teaming asks a security team to test a system as an attacker might, then use the findings to improve its defences. In Cisco’s description, AI Defense can build multi-step tests around a customer’s specific application or agent. The company says Mythos will help create contextual attack paths that probe for weaknesses across connected components.

Cisco has described several limits around the service. Targets must be registered and authorized by the customer. Each engagement is linked to a named operator, runs against a fixed job and objectives, and can be stopped. Cisco says the interface does not expose unrestricted prompts to customers. These controls matter because testing techniques can be misused if a powerful system is pointed at targets without clear authorization.

The distinction is important: Cisco is announcing a managed product capability, not public access to Mythos. The company says the integration is still coming to select enterprises. Teams considering similar tools should define the assets they own, the actions an agent is allowed to take and who can approve a test before any assessment begins. A clear AI agent security policy should define approved systems, data access and test objectives in advance.

A controlled test environment for evaluating an AI agent — Authorized red-team exercises can help expose weaknesses before deployment.

Observability for agents, not just models

Security is only one part of the announcement. Cisco’s Splunk Agent Observability updates are designed to help teams see what an agent did, which tools it used, how well it performed and what it cost. One feature, called Tokenomics, is intended to connect token spending with evaluations of the work’s quality and impact.

Cisco says Tokenomics will enter private preview in December, with broader availability planned for early 2027. The company also announced evaluation models and a tuner that can use agent traces and expert feedback to check whether a system meets a team’s standards. Those details point to a wider shift in enterprise AI: operators want a record of an agent’s actions, not only an answer on a screen.

As part of AI agent security work, that kind of record can help surface problems such as repeated tool calls, unexpected data access or a task that consumes more resources than expected. It does not replace human review or security controls. Organizations still need to decide which actions require approval, how to handle sensitive information and how to investigate a result that looks wrong.

A secure data centre supporting enterprise AI systems — Clear access limits and useful logs are part of a controlled AI deployment.

What companies should ask before deployment

Before allowing an AI agent to act on real systems, teams can map its permissions, restrict it to approved data and test how it responds to misleading instructions. They should also make sure a person can interrupt its work and that logs capture decisions, tool calls and outcomes. A red-team report is most useful when findings lead to fixes and a repeatable retest.

Cost monitoring belongs in the same conversation. A low-cost answer is not useful if it is inaccurate, and a high-performing agent may still be wasteful if it repeats work. Connecting spending to quality measures gives teams a more meaningful basis for deciding which tasks are suitable for automation.

Funzug has previously looked at machines taking on service tasks in its story about the robot restaurant in Harbin. Software agents work differently, but the same question applies: what should a system be allowed to do on its own, and where should a human stay in control?

Read Cisco’s announcement for the product roadmap and safeguards. For organizations, the useful takeaway is measured rather than dramatic: agent security depends on authorized testing, clear limits, useful logs and a person who can intervene.