123 Reg, the UK domain registrar owned by GoDaddy, says it suffered "the first known AI-driven cyberattack against our company" on September 18, 2026, and that customer contact and product data was read. According to The Register's report, customers began receiving notification emails this week. The company also suspects a China-nexus actor and wonders whether it is the same group that used the ARTEX agentic pentest tool against South Korean financial firms. Those attribution points are the company's own assessment, so this post separates what is confirmed from what rests on the registrar's word alone.
| Question | Short answer |
|---|---|
| Am I affected? | If you are a 123 Reg customer and received the notification email, yes: contact and product data was exposed |
| What was taken? | Names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences, VAT numbers |
| Is the "AI-driven" label verified? | Not independently. It is the company's description; no technical report has been published |
| Is the ARTEX link verified? | No. It is a suspicion based on infrastructure and artefacts the company says it found |
| What should I do? | Treat unexpected contact as suspect, log in via the website, turn on two-step verification |
| Does data leave my machine because of this? | Not from a local coding agent. The exposure sits in the registrar's systems |
What 123 Reg has said
The facts below come from the customer email and a company spokesperson, as relayed by The Register. We could not find a notice on the registrar's own site, and no technical write-up has appeared, so the report is the best available record.
- Date: the intrusion began on September 18, and customers were notified in the week of October 26. That is roughly six weeks between the intrusion and the email.
- Data: the email lists contact information, "related customer relationship data", company VAT numbers and "product information from an application programming interface (API)". The spokesperson spelled this out as names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account and marketing preferences.
- Scope of activity: the email says the attacker's activity "was limited to reading". The spokesperson added that it is possible the attacker created copies, and that this is what triggered the notification.
- Response: the company reported the incident to law enforcement, brought in outside cybersecurity support and notified the FTC and the data protection authorities in the UK and the EU. It worked with Singapore-based ISPs to take down attacker servers in that region.
- Advice to customers: be alert to misuse of the data, go directly to the website if unsure whether a message or call is genuine, expect that 123 Reg will never ask for passwords, payment details or verification codes by email, text or phone, and turn on two-step verification.
What the company asserts but has not shown
The more interesting claims are about who and how. The spokesperson told The Register that:
- The attacker infrastructure the investigation identified as "core" was hosted in China and Singapore, indicating "a strong Chinese nexus".
- The investigation found AI cyberattack "skills" hosted on Chinese infrastructure, "including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts".
- The attacker's mirror of
anthropic_skillsand the account naming conventions on the Chinese servers are "consistent with preparation of this class of AI-augmented operation". - The artefacts led the company to suspect a Chinese state-sponsored group previously described as abusing Claude Code in attacks against at least 30 organizations.
- ARTEX was observed in the attack on 123 Reg, and the actor may be the same one that CrowdStrike described on October 7 as targeting South Korean financial organizations.
No indicator list, session transcript or timeline has been published to back these up. The company is a credible first-hand source for what happened on its own systems, and a reasonable one for the infrastructure it found. It is a weaker source for attribution, because attributing intrusions to a named group usually takes cross-victim data that a single victim does not have.
Claimed vs. verified
| Claim | Status | Source and note |
|---|---|---|
| A September 18 intrusion exposed customer data | Company-confirmed | 123 Reg's email and spokesperson, via The Register. No independent check |
| Data was limited to contact and product information | Company-stated | Customers should still read their own notification for scope |
| The attack was "AI-driven" | Unverified | No tool, prompt log or timing data published. The phrase may describe agentic tooling or may be loose language |
| Attacker infrastructure in China and Singapore | Company-stated | Singapore ISPs reportedly helped take servers down; no IPs published |
| Copies of Anthropic-published skills were hosted by the attacker | Company-stated | Plausible, since the skills are public, but not shown. A copy of a public skill is not evidence of a specific group |
| ARTEX was used against 123 Reg | Company-stated | Not stated in CrowdStrike's public report, which covers South Korean finance |
| Same actor as the South Korean bank intrusions | Unverified | Overlap in timing (late September) and tooling only. Many actors use the same open-source tool |
| A Chinese state-sponsored group is responsible | Suspicion | Company wording is "suspect". No third party has attributed it publicly |
What we know about ARTEX from primary sources
The reason the claim is believable is that ARTEX is documented elsewhere. CrowdStrike's October 7 report describes an unattributed, likely Chinese-speaking and financially motivated actor that used ARTEX, a recently released open-source agentic pentesting tool developed in China, together with large language models against South Korean financial organizations from late September to early October 2026. The analysis found open directories holding Claude Code session histories, ARTEX configuration files and Claude memory files, and CrowdStrike assessed with moderate confidence that the actor was a Chinese speaker. That report does not mention 123 Reg, and it explicitly says the activity was not attributed to a named adversary.
Our earlier posts cover the South Korea bank campaign and the Claude Code session leak and Microsoft's Storm-0940 report, which used the same framework. Microsoft says more than one actor in more than one region has used ARTEX. That matters for attribution: a shared open-source tool is evidence of shared tooling, not of one operator. The same caution applies to the Anthropic-skills mirror. The skills are public, anyone can copy them, and finding a copy on a server shows what the operator downloaded, not who they are.
The "at least 30 organizations" reference appears to point to Anthropic's earlier reporting on a state-sponsored campaign in which Claude Code was used for intrusions; our summary of Anthropic's reporting is in the September 2026 threat report post. We have not seen anything linking that campaign to 123 Reg beyond the spokesperson's comment.
Why the "AI-driven" label needs care
"AI-driven" can mean several things in an incident report: an LLM wrote the exploit code, an agent framework like ARTEX chained reconnaissance and exploitation, or a human used a chatbot for help with scripts. These have different defensive consequences. An agent that adapts to rate limits and runs 24 hours a day looks different in logs from a human who pasted a chatbot's output. Wiz CIRT described tells of an agent-run intrusion in a different case, covered in our Wiz AI-driven cloud attack post: credentials chained at machine speed and pentest-named resources.
123 Reg has not said which of these it observed, nor how it concluded the attack was AI-driven. The company's wording about "skills" suggests the actor's toolchain included agent skills, which is consistent with the Claude Code-based workflows CrowdStrike saw, but that remains an inference. We also remain cautious because the label has become attractive for press releases: a recent TypeSafe AI incident was a joke and not an attack, and breach notices increasingly use AI framing to explain speed or sophistication. Until indicators are published, readers should treat the label as unverified.
What this means if you run AI coding agents
You are not the target here, but a few points transfer to your own setup.
- Skills are attack tooling too. The reported detail that attackers mirror Anthropic's open-sourced skills shows that agent skills are copyable building blocks for offence. The same property makes them a supply-chain risk for you: a skill you install is instructions an agent will follow. Read a skill before enabling it, and prefer pinned versions.
- Read-only access is still a breach. The company says the attacker only read data via an API. For your own projects, an agent token with read scope can still leak data. Give agents the narrowest credentials that work and keep production API tokens out of their reach.
- Expect the phishing follow-up. The data set (names, phone numbers, which products you have) is what a convincing impersonation needs. If you hold domains at 123 Reg, check the registrar contact details, turn on two-step verification and look at the domains and DNS records for unexpected changes. Your domains are what a hijacker would want, and the notice does not say they were touched.
- Do not paste the notice's claims into your own incident reports as fact. Record that the registrar said an "AI-driven" attack occurred, who said it, and when.
- Check your own logs for agent-style traffic. Long sessions, rapid sequential API calls with adapted payloads and requests that follow each other's output are the patterns defenders have linked to agent frameworks. They are hints, not proof.
What Beam can and cannot do here
Beam does not apply to the registrar's side of this incident: it cannot see 123 Reg's systems or your account there, and it does not detect phishing. Where it does help is the local part of the lesson. Beam watches what Claude Code, Codex and similar agents do on your machine, flags credential exposure and destructive commands, and scans skills and MCP configs before you run them using 11 heuristics plus an MCP version-pin check. That scan is heuristic, not semantic malware analysis, and Beam's deny works through hooks for Claude Code and Codex rather than a kernel sandbox. Everything stays on-device. See how it works and what Beam watches.
What to watch for next
- A technical write-up or indicator list from 123 Reg or GoDaddy, which would let others confirm the infrastructure and tooling claims.
- Any third-party attribution, for instance from CrowdStrike, Microsoft or Wiz, linking the activity to the ARTEX operators.
- Regulator notices from the UK Information Commissioner's Office or EU authorities, which can add detail on the number of customers affected. The company has not given a count.
- Any report that domains or DNS records were changed. Nothing so far says they were.
We will update this post if any of these appear. The incident also joins the other ARTEX-linked cases in the October 2026 attacks timeline, and Japanese firms saw similar tooling in the CyberStrikeAI case.
Frequently asked questions
What did 123 Reg say happened?
It says an AI-driven attack on September 18, 2026 read customer data: names, phone numbers, countries, language and currency preferences, account creation dates, products on the account and marketing preferences. The company says the activity was limited to reading, though copies may have been made.
Is the link to ARTEX and the South Korean bank attacks confirmed?
No. It is 123 Reg's own assessment, based on attacker infrastructure it says it found and artefacts such as a mirror of Anthropic skills. CrowdStrike's public report on ARTEX concerns South Korean finance and does not mention 123 Reg.
Were passwords or payment details taken?
The company's notice lists contact data, VAT numbers and product information from an API. It did not list passwords or payment details as affected, but it still advises customers to enable two-step verification and distrust unexpected contact.
Does this affect people who run AI coding agents?
Only indirectly. Customers of the registrar should watch for phishing. For agent users, the notable detail is that attackers reportedly reuse publicly available agent skills as offensive tooling, which is a reason to review the skills you install.
How should I respond if I am a 123 Reg customer?
Treat unexpected messages or calls claiming to be from 123 Reg with caution, log in by typing the website address yourself, turn on two-step verification, and review which domains and products are on the account.
Related reading
- South Korea bank hack: ARTEX, LLMs and Claude Code sessions
- Storm-0940 and ARTEX: the ConnectWise attack
- Anthropic's September 2026 threat report
- Anatomy of an AI-driven cloud attack
- October 2026 attacks timeline
- The Register's report on the 123 Reg disclosure
- CrowdStrike: unknown threat actor uses ARTEX
Details reflect the company statements reported on October 28, 2026 and may change as 123 Reg publishes more. Beam is a local prototype; features described are as documented at the time of writing.