Claude Mythos, the Anthropic bug-finding model that has so far been offered only through controlled access programs, is heading into two big enterprise security products. On November 9 and 10, 2026, Cisco said it is adding Claude Mythos to its AI Defense red teaming tools, and IBM said it plans to put Mythos-powered code scanning into IBM Concert Protect.
Both companies take the same approach. Customers get what the model finds, inside a product with set limits. They do not get a chat box where they can prompt Mythos however they like.
What Cisco is adding
Cisco AI Defense is a security product for AI applications and agents. It already runs two kinds of red team tests, according to a Cisco blog post by Amy Chang and Vikram Varakantam. Standard red teaming checks for common problems such as prompt injection, jailbreaks, sensitive data exposure, and harmful content. Adaptive red teaming lets a user describe custom test goals in plain language. The framework then studies the target system, builds attacks for those goals, and changes tactics based on how the target responds.
Mythos goes into the adaptive side. In the Cisco press release, Cisco says the model will add "advanced reasoning that plans tests that matter and translates the results into attack ideas for each system." The release lists three features: multi-step attack paths, access only through AI Defense's structured interface with "no open-ended prompt access", and an audit record of each testing action.
Cisco also lists four safeguards:
- Mythos runs only against targets that the customer has registered, owns, and is authorized to test. Cisco says it "cannot scan arbitrary internet infrastructure."
- Every engagement requires authentication and is cryptographically tied to a named enterprise operator.
- Each engagement has a fixed job and objectives set by a human user, with time-bound sessions that can be stopped on demand.
- Cisco's product controls in AI Defense sit alongside program-level safeguards and monitoring.
Michael Moore, Cybersecurity Lead at Anthropic, said in the release: "By bringing Claude Mythos to Cisco AI Defense, Cisco can help security teams red team their agents with advanced reasoning that plans tests and generates attack ideas for each system."
Availability is limited for now. Cisco says adaptive red teaming with Claude Mythos is "coming soon for select enterprises." The blog adds that broader availability is planned for qualified customers "on a when-and-if available basis," and that dates, scope, and regions may change. The Register reported that Cisco will make Mythos available under users' existing licenses, without additional cost.
What IBM is planning
IBM's plan is about finding bugs in a company's own code. IBM Concert Protect is its enterprise exposure management platform. IBM says the planned feature would have Mythos analyze "customer-selected repositories" to help find unknown weaknesses, "including complex logic flaws and potential zero-days that conventional scanners may miss."
IBM describes the flow in three steps:
- Scan. Mythos would reason across customer-selected application code to help find previously unknown vulnerabilities, including weaknesses with no existing signatures or CVE records.
- Prove. Concert Protect's Proof of Exploitability feature looks at code, configuration, and infrastructure context to judge whether a flaw can really be exploited, and gives supporting evidence.
- Fix. Concert Protect, together with Red Hat Lightwell, generates targeted fixes. Developers review and approve them through automated pull-request workflows.
Mythos findings would go into Concert Protect's existing vulnerability workflow next to results from traditional scanners, rather than into a separate tool. IBM's argument is that finding bugs is no longer the hard part. "The bottleneck is no longer finding vulnerabilities," the announcement says. "It is determining which can actually be exploited and fixing them before attackers do."
IBM says general availability is planned for early 2027, and that its statements about future direction may change or be withdrawn without notice.
How this fits Anthropic's Mythos access rules
IBM says it already worked with Anthropic through Project Glasswing, and that this work "focused on internal security research and evaluation." IBM calls the Concert Protect plan "a new step toward bringing Claude Mythos' capabilities to enterprise customers through a governed operations platform."
The Register reported that Anthropic first offered Mythos through Project Glasswing, which gave vetted organizations access to test their codebases, and has since widened access through other controlled programs. According to The Register, Natalie Mead, Anthropic's head of applied AI for the Asia-Pacific, said the company has a long queue of buyers who want Mythos and that working with Cisco will make it easier to meet that demand. When The Register asked whether Anthropic had similar deals with other companies, Mead did not say.
Earlier, on October 29, SentinelOne said it would add Claude Mythos 5.1 to its Wayfinder services. The same week as the Cisco and IBM news, Anthropic released Claude Fable 5.2 and Mythos 5.2.
Why it matters
According to The Register, Mythos access has run through controlled programs such as Project Glasswing. These deals add another route. A security team that already pays for Cisco AI Defense or IBM Concert could get Mythos-backed testing inside a tool it already uses, with the target, the operator, and the audit trail fixed by the vendor.
The design choice is the main story. Cisco calls the setup "an early instance of a broader shift, in which the frontier capabilities most relevant to security are made available to defenders under verified, controlled access rather than withheld from everyone." The same capability cuts both ways, as Cisco's release notes. That is why both vendors stress limits: registered targets, named operators, human-set goals, and fixes that a developer must approve. For background on how an earlier Mythos model behaved in a government cyber test, see our story on Anthropic's review of the UK AISI cyber test incident.
Neither product is generally available yet. Cisco has not given a date beyond "coming soon for select enterprises," and IBM's target is early 2027.
Sources
- Cisco Newsroom: Cisco Unveils Frontier AI Red Teaming and Agent Observability to Secure the Agentic Enterprise
- Cisco Blogs: Cisco AI Defense to Add Anthropic's Claude Mythos for AI Red Teaming
- IBM: IBM plans to bring Anthropic's Claude Mythos cyber reasoning into IBM Concert
- The Register: Anthropic's super bug-finding Mythos model is going into Cisco and IBM products
