Anthropic Magic Link Second Factor Disabled

Last updated 5 days ago on 2026-09-21

Created 14 days ago on 2026-09-12

About

Magic link second factor adds an extra authentication step to passwordless sign-in for Anthropic. An attacker with administrative access can turn it off so magic link logins no longer require the second factor, which makes stolen or attacker-controlled mailboxes usable for interactive access. This often shows up alongside SSO weakening when the attacker wants a fallback authentication path outside the corporate IdP.

Tags

Domain: GenAIDomain: IdentityPlatform: AnthropicData Source: Anthropic Audit LogsUse Case: Identity and Access AuditUse Case: Threat DetectionRule Type: ES|QLTactic: Defense EvasionLanguage: esql

Severity

high

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Modify Authentication Process (T1556)(external, opens in a new tab or window)

False Positive Examples

Administrators disable magic link second factor during authentication policy changes or troubleshooting. Verify the actor and whether the setting was re-enabled or replaced with an equivalent control.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: anthropic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "org_magic_link_second_factor_toggled" and
    anthropic.audit.enabled == false
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*

Install detection rules in Elastic Security

Detect Anthropic Magic Link Second Factor Disabled in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).