Cisco plans to use Claude Mythos to red-team AI agents

Limits on scope

The most specific detail in Cisco's statement is the boundary. Assessments will cover only targets that customers own and have authorized for testing. That rules out probing third-party systems or anything without explicit permission, a point that matters whenever a capable model is used for offensive security work.

The company has not, in the information available, described how the testing will be run, when it will start, or which products or customers will be involved. Those details remain unclear.

Why it matters

As businesses give AI agents access to tools, data and workflows, security teams need ways to check how those agents behave under attack. Pairing a network and security vendor with an advanced model for that task signals that agent security is becoming a distinct testing discipline. The explicit authorization limit also shows how vendors are trying to frame such work as controlled and consent-based.