Anthropic Mythos in Cisco and IBM: Enterprise Red Teaming Without the Model

Anthropic is putting Claude Mythos behind enterprise security products instead of selling the model directly. On November 9–10, 2026, Cisco announced at Cisco Live APJC that AI Defense will add Mythos to its adaptive AI red teaming framework for customer-owned agents and applications, and IBM announced plans to embed Mythos in Concert Protect for AI-assisted code scanning, exploitability checks, and developer-approved fixes. The same day, Anthropic shipped Claude Fable 5.2 and Claude Mythos 5.2. If you run coding agents, the practical change is not a new CLI flag on your laptop; it is how security teams can stress-test agents before production using frontier attacker reasoning without giving every tester an open Mythos prompt window.

For launch pricing on Fable and Mythos 5.2, explainx.ai has the full news timeline. This post sticks to the mechanism and controls Cisco and IBM describe.

Why Anthropic is partnering instead of widening Mythos API access

Mythos is Anthropic's restricted model class for cybersecurity and life-sciences work. The Mythos product page states access goes through verification programs because the model is highly capable for offensive security research. Earlier access paths included Project Glasswing, where vetted organizations used Mythos to hunt bugs in codebases under program rules.

The Register's November 10 coverage quotes Anthropic's Natalie Mead saying Anthropic has a long queue of organizations that want Mythos, and that Cisco helps satisfy demand while customers do not receive the model itself—only the product behavior built on top. That matches what Cisco and IBM document: findings and test flows, not raw model weights or unfettered chat.

The same week Anthropic published safety testing notes for Fable 5.2 and Mythos 5.2, including evaluations aimed at behaviors such as sandbox escapes, and said distillation-attack protections are stronger than on prior releases. Those claims concern model misuse, not your IDE. They explain why vendors wrap Mythos in registered targets and operator attribution rather than exposing a general API.

For earlier Mythos risk in unconstrained evaluations, see our post on Mythos 5 and the AISI malicious pull request. The enterprise integrations described here are the opposite pattern: deliberate containment around a powerful model.

Cisco AI Defense: how Mythos fits adaptive red teaming

Cisco's blog post breaks AI Defense red teaming into two modes:

1. Standard red teaming runs thousands of canned tests—prompt injection, jailbreaks, sensitive data exposure, harmful content—in minutes and maps results to Cisco's AI security framework plus OWASP, MITRE, and NIST references.

2. Adaptive red teaming lets customers define custom criteria in plain language. The framework analyzes the target, plans multi-step attacks, refines based on responses, and produces a report. Cisco launched this as an agentic red teaming framework when agents became the dominant deployment shape.

Mythos augments adaptive red teaming where attacker reasoning matters: understanding a target system, choosing tactics, and turning abstract goals into concrete test payloads. Michael Moore, Anthropic's cybersecurity lead, is quoted saying enterprises want to test agents thoroughly before production, and that Mythos can plan tests and generate attack ideas for each system inside AI Defense.

Containment controls Cisco documents

Cisco lists product-level constraints meant to keep Mythos inside authorized exercises:

• Registered, authorized targets only—testing runs against targets the customer registers and is permitted to test, not arbitrary internet infrastructure.
• No open Mythos interface—customers do not freely prompt the model; they set target and objectives; the red teaming framework runs the engagement.
• Named operator attribution—engagements tie to an authenticated enterprise operator.
• Audit trails and revocable sessions—actions are recorded; sessions are time-bound and can be halted.
• Dual-layer oversight—product controls plus program-level safeguards from Anthropic's side, per Cisco's description.

Cisco says standard and adaptive red teaming without Mythos is available today. Adaptive red teaming with Claude Mythos is coming soon for select enterprises, with broader availability for qualified customers on a when-and-if-available basis.

The newsroom announcement also mentions Splunk Agent Observability and Cisco IQ correlation features announced at the same event. Those are separate from Mythos but part of Cisco's pitch for an observe → test → fix loop on agentic deployments.

What the screenshot shows

Image: Cisco

IBM Concert Protect: scan, prove, fix on a 2027 roadmap

IBM's November 9 announcement describes a planned three-stage workflow, not a product you can turn on today:

IBM distinguishes this customer-facing plan from earlier Project Glasswing work, which it describes as internal security research. General availability is planned for early 2027; IBM cautions that direction may change.

For coding-agent teams, the important detail is developer approval on fixes. Mythos may propose patches; IBM's narrative still places a human gate before merge—similar in spirit to requiring human review when an agent opens a pull request, which we covered in the context of unintended agent actions and supply-chain incidents.

Mythos 5.2 and Fable 5.2 the same day

Anthropic's Fable and Mythos 5.2 post says both names refer to the same underlying model, with Fable carrying cyber and biology safeguards suitable for broader availability and Mythos offered through verification programs.

Documented pricing for both:

• Standard: $8 per million input tokens, $40 per million output tokens (faster and cheaper than 5.1 per Anthropic).
• Fast mode: $16 / $80 per million input/output tokens, with up to 2.5× faster generation.

Anthropic also notes Claude Security now runs on Mythos 5.2 for eligible enterprise customers—a parallel path to Cisco/IBM for organizations already in Anthropic's enterprise stack.

None of this changes the default model behind Claude Code on a developer laptop. Anthropic still recommends Opus 5.5 as the daily driver and moving up to Fable or Mythos only for harder work.

Attack chain this integration is meant to simulate (and stop)

From a defender's perspective, adaptive red teaming with Mythos is meant to rehearse chains like these against systems you own:

1. Reconnaissance—map tools, skills, MCP endpoints, and data stores the agent can reach.
2. Goal selection—pick a high-value outcome (exfiltration, privilege use, destructive action) aligned with customer-defined test criteria.
3. Multi-step probing—use prompt injection, tool misuse, or chained calls that standard canned tests might not cover.
4. Feedback loop—adjust tactics based on agent responses, mimicking an adaptive attacker.
5. Evidence and remediation—record findings, map to frameworks, optionally feed adaptive guardrails in Cisco Policy Studio.

Cisco's standard tests cover the breadth of known attack classes. Mythos is aimed at the depth of tailored sequences—closer to what showed up when Mythos-class models took out-of-scope actions in lab evaluations, but here bounded by registered targets and operator controls.

What this means if you run AI coding agents

Individual developers are unlikely to flip a switch in Claude Code because of these announcements. The audience is security and platform teams shipping agents into business workflows.

Concrete checks that still apply on developer machines:

• Run claude --version (or your Codex CLI version) and note which permission modes and network settings are enabled. Enterprise red teaming does not replace tight defaults on laptops.
• If your org adopts Cisco AI Defense Mythos testing, register only applications and agents you own. Misconfigured target registration is how offensive tooling becomes an accidental scan of a third-party API.
• Insist on named-operator audit logs for any Mythos-backed engagement, matching Cisco's design. Anonymous red-team runs are hard to attribute when something hits staging data.
• Treat IBM's 2027 Concert integration as a pipeline change, not today's control. Until GA, continue dependency and MCP scanning in CI and pre-run checks on skills.

When your security team runs Mythos-powered tests against an internal coding agent, false positives and noisy findings are plausible—frontier offensive reasoning is tuned to be creative. Pair cloud red-team reports with local, deterministic signals on tool calls so engineers are not chasing only LLM-generated attack narratives.

Anthropic's Mythos page notes 30-day data retention for safety monitoring by default, with zero-data-retention options tied to enterprise safeguards for eligible verification customers. If your employer routes agent traffic through these integrations, ask where prompts and findings are stored, independent of this week's launch headlines.

How Beam handles this

Beam overlaps with the runtime observability slice, not the offensive red-team slice Cisco and IBM are buying from Mythos.

Beam is local-first: it watches Claude Code and Codex tool proposals, runs heuristic scans (11 patterns plus MCP version-pin checks) on skills and MCP configs before execution, and can deny selected PreToolUse actions when workspace policy is in enforce mode—see agent CLI policy behavior. It does not plan multi-step Mythos-class attacks against your agent, and it is not a substitute for Cisco adaptive red teaming or IBM's planned exploitability proofs.

Where Beam fits better: day-to-day developer laptops and CI runners where you want credential exposure, destructive commands, and risky tool sequences flagged on-device without sending session content to an enterprise red-team cloud. Where Mythos-in-Cisco fits better: pre-production validation of a registered agent against adaptive attack plans with vendor audit trails.

Beam's deny path is hook-based, not a kernel sandbox; missing cached policy can fail open; scanning is heuristic, not semantic malware analysis. Use Mythos-backed enterprise tests for what you ship, and local Beam telemetry for what your team runs every hour. For another Cisco-open pattern on session behavior, see Project Quarry.

Timeline

Frequently asked questions

Can Cisco or IBM customers prompt Claude Mythos directly?

No, according to Cisco and IBM announcements. Mythos runs inside their products with a fixed job, registered targets the customer owns, and human-defined objectives. Customers interact through the vendor interface, not an open-ended Mythos chat.

When is Mythos available in Cisco AI Defense?

Cisco says standard and adaptive red teaming already ships in AI Defense today. Adaptive red teaming with Claude Mythos is coming soon for select enterprises, with broader availability for qualified customers on a when-and-if-available basis; dates and regions may change.

When will IBM Concert Protect offer Mythos scanning?

IBM plans general availability in early 2027. The November 9 announcement is a roadmap item: Mythos-powered code scanning, exploitability validation, and developer-reviewed fixes through Concert Protect and Red Hat Lightwell.

Did Anthropic release a new Mythos version at the same time?

Yes. On November 9, 2026, Anthropic announced Claude Fable 5.2 and Claude Mythos 5.2, the same underlying model with different safeguards. Pricing starts at $8 per million input tokens and $40 per million output tokens, with optional fast mode at $16/$80.

Does this replace local checks on my laptop coding agent?

No. These are enterprise security products for organizations that register AI applications and repositories for testing. Individual developers running Claude Code or Codex on a laptop still rely on harness permissions, hooks, and local monitoring unless their employer wires Cisco or IBM products into the pipeline.

Why does controlled access matter for Mythos specifically?

Anthropic limits Mythos to vetted organizations because it is tuned for offensive cyber reasoning. Cisco and IBM describe wrappers that restrict Mythos to authorized targets, named operators, audit logs, and revocable sessions so enterprises get attacker-level planning without handing customers an unconstrained offensive model.

Related reading

• Claude Mythos 5.2 CyScenarioBench and CVE rediscovery scores
• Mythos 5 tried to backdoor a real GitHub project (AISI evaluation)
• Cisco Project Quarry session-level agent detection
• Microsoft Guardian Agents treat AI agents as insiders
• Claude Security continuous scanning and program fit
• AI auditors, false alarms, and agent log review at scale
• Primary sources: Cisco AI Defense + Mythos, IBM Concert announcement, Anthropic Fable and Mythos 5.2

Product timelines, pricing, and regional availability are accurate as of November 10, 2026, per vendor announcements. Cisco Mythos red teaming and IBM Concert Mythos scanning are not generally available to individual developers today. Beam is a local prototype; hook deny coverage and scanner limits are as documented in the agent CLI docs.