Detection of Multiple Authentication Failures on Anthropic Accounts

The observed threat involves repeated, failed authentication attempts against specific Anthropic user accounts, a pattern indicative of credential brute force, credential stuffing, or the abuse of stale magic links. This activity is characterized by a high volume of failed events - specifically magic-link or SSO login attempts - targeting a single user email address within a 60-minute window. Security teams should distinguish between high-diversity source IP patterns, which suggest automated credential stuffing or proxy rotation, and low-diversity patterns that typically result from user error or misconfigured identity provider (IdP) integrations. Because Anthropic services are often integrated into enterprise environments, detecting this activity is critical for preventing unauthorized access to sensitive GenAI workflows and data.

Impact

Successful exploitation of these authentication weaknesses can lead to full account takeover. If an attacker gains unauthorized access, they may exfiltrate sensitive data, manipulate GenAI model configurations, or leverage the account to conduct further attacks within the enterprise. The risk is particularly high if the compromise is followed by the weakening of second-factor authentication or the addition of rogue administrative access.

Recommendation

Detection engineering teams should implement monitoring for Anthropic audit logs to identify these patterns.

• Monitor Anthropic authentication logs for at least five failed attempts against a single email address within one hour.
• Use the provided ES|QL logic to aggregate failures by user.email and evaluate source_ip_distinct_count to assess if the activity is distributed (high diversity) or localized (low diversity).
• Correlate authentication failures with successful logins from unfamiliar IP addresses or subsequent administrative actions such as SSO configuration changes.
• In confirmed takeover scenarios, invalidate existing sessions, force password and MFA resets, and audit access logs for suspicious data retrieval or model interactions.