On 31 July 2026, Microsoft Threat Intelligence published a campaign note under the name CaptiveCrunch. It described traffic manipulation on hospitality captive-portal networks: DNS and HTTP redirected so that a guest joining hotel or conference Wi-Fi could be steered into lookalike Microsoft sign-in pages, device-code authentication traps, or fake browser and OS updates.[1] Microsoft attributed the work to Storm-2945, which it assessed as a sub-cluster of Midnight Blizzard (the Russia-linked actor also tracked as APT29 / NOBELIUM / Cozy Bear, and attributed by the US and UK governments to the SVR).[1][2] Microsoft also thanked Anthropic and OpenAI for collaboration on the investigation.[1]
Six weeks later, on 10 September 2026, Anthropic released its most detailed threat-intelligence report to date: Detecting and countering misuse of AI: September 2026.[3] Among the cyber cases is GTG-20006, an actor Anthropic says is consistent with public reporting that links it to Midnight Blizzard. Anthropic’s account of that cell includes AI-driven rebuilds of malware when security products flagged it, device-code phishing against cloud mail, and DNS hijacking through compromised hospitality vendors (the same pattern Microsoft had already named CaptiveCrunch).[3][1]
That overlap is the point of this series. The Anthropic report is treated here as the primary disclosure of how Claude was used inside those operations. External sources place named techniques, actor labels, and timelines from the public record beside Anthropic’s cases, not to re-litigate whether the cases occurred.
The September report’s scope
Anthropic’s Threat Intelligence team says it disrupted activity between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and illicit distillation.[3] The misuse cases it highlights used Claude Haiku, Sonnet, and Opus. Anthropic states that none involved Claude Fable or Mythos-class models, with one exception in the distillation section.[3]
The report is explicit about what it is not: a catalogue of ordinary abuse. Anthropic presents “the most notable and novel threat activity” it identified, spanning suspected state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals.[3]
Two sentences from the cyber section carry the thesis of this opener. First: “The cybersecurity skills of AI models means that AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.”[3] Second: “For threat intelligence investigators, sophistication has stopped being a reliable signal of who is behind an operation.”[3] Anthropic’s own examples in that paragraph are a hacktivist on stolen API keys, financially motivated individuals, and a state espionage operator, each sustaining multi-victim campaigns that, in Anthropic’s judgement, would have required many skilled operators a year earlier.[3]
That claim is narrower than the internet’s habit of saying “AI changes everything.” It is a claim about who can run a campaign that looks expensive, and about how little “polish” now tells you about the sponsor.
How this series is organised
The Claude Misuse Files follows Anthropic’s seven harm areas, with this Part 1 as the map:
1. Part 1 – The hotel login page was the front door (this essay)
2. Part 2 – Humans still pick the target (Cyber)
3. Part 3 – Seventy fake newsrooms, one agency (Influence)
4. Part 4 – One consultant, twenty-five million SIMs (Surveillance)
5. Part 5 – Three bots for every real face (Scams)
6. Part 6 – Software on the boards (Weapons)
7. Part 7 – When the classifier works and the relay does not (Biology)
8. Part 8 – Silent proxies (Distillation)
Each later part keeps the same rule: Anthropic supplies the case spine; outside literature supplies technique history, actor nomenclature, vendor advisories, and numbers that sit beside the disclosure. Where a fact exists only in Anthropic’s report, it will be labelled as such.
Why start at the hotel Wi-Fi
CaptiveCrunch is a useful first image because three independent layers already exist in public.
Microsoft’s campaign write-up (31 July 2026) includes indicators of compromise such as ms365-live[.]com, m365-owa[.]com, owa-ms365[.]com, and ms365-device[.]com, plus hashes for implants it tracks as CornFlake and ChocoShell.[1]
Anthropic’s GTG-20006 narrative names CaptiveCrunch, hospitality DNS hijacking, device-code phishing, and an AI loop that rebuilds implants after detection.[3]
Prior device-code phishing literature for Midnight Blizzard-linked activity includes Microsoft’s February 2025 Storm-2372 note (later assessed as a Midnight Blizzard initial-access sub-cluster) and related industry coverage of Entra device-code abuse (Microsoft’s cloud identity system).[4][5]
You do not need to believe a metaphor about “AI agents taking over the internet.” You need a hotel network whose captive portal can answer DNS, a legitimate OAuth flow that can be aimed at the wrong session, and an operator who can iterate malware faster than a static signature cycle. Anthropic’s contribution, on its own terms, is the claim that Claude sat inside that loop for GTG-20006, from tool rebuilds to phishing infrastructure to exfiltration support.[3]
The rest of the series walks the other six harm areas with the same discipline. The map is Anthropic’s. The footnotes are the public record around it.
Notes
[1] Microsoft Threat Intelligence, “CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft,” Microsoft Security Blog, 31 July 2026. https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
[2] Microsoft Security Insider, “Midnight Blizzard (NOBELIUM).” https://www.microsoft.com/en-us/security/security-insider/threat-landscape/midnight-blizzard
[3] Anthropic, “Detecting and countering misuse of AI: September 2026,” published 10 September 2026. https://www.anthropic.com/threat-intelligence-report-september-2026 ; announcement post, @AnthropicAI, 10 September 2026. https://x.com/AnthropicAI/status/2098097512544444447
[4] Microsoft Threat Intelligence, “Storm-2372 conducts device code phishing campaign,” Microsoft Security Blog, 13 February 2025 (page updated July 2026 noting Storm-2372 assessed as a Midnight Blizzard initial-access sub-cluster). https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
[5] Volexity, “Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication,” 13 February 2025. https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication