JetBrains pulls 15 Marketplace plugins that stole AI API keys from developers

JetBrains has removed 15 third-party plugins from JetBrains Marketplace that were designed to steal AI provider API keys from developers, the company said in a security update. JetBrains received reports of the plugins on June 16, pulled all 15, permanently banned seven publisher accounts, and used a backend kill-switch to remotely disable the plugins on installed development environments. No JetBrains core systems were compromised, the company said.

The plugins posed as AI coding assistants, code-review tools, and Git utilities powered by OpenAI, DeepSeek, and SiliconFlow, and together drew roughly 70,000 installs. The two most downloaded were DeepSeek AI Assist, with 27,727 downloads, and CodeGPT AI Assistant, with 25,571. The campaign was active since October 2025, with the most recent plugin published on June 10, 2026. It was discovered by independent security researcher Ilyas Makari.

When a developer entered an API key and clicked Apply, the plugin transmitted the key as plaintext JSON over HTTP to a hardcoded command-and-control address, 39.107.60[.]51, according to the research. The plugins also silently installed a JVM-wide X509TrustManager to suppress TLS warnings and evade local network detection. The attackers ran a paid tier in which, for a small fee, a user received a working AI provider API key, which researchers theorize were keys harvested from free-tier victims, a scheme known as LLMjacking. That monetization framing is the researchers' interpretation of the operation.

JetBrains said it is adding new rule layers to flag unencrypted raw IP endpoints, global TLS-weakening behavior, and plugin handling of sensitive cloud API keys. The company updated its security post on June 18.

Developers who installed any of the listed plugins should revoke every API key they entered, check their AI provider usage dashboards for anomalous activity, and block 39.107.60[.]51 at the network perimeter. The incident adds to a run of supply-chain attacks targeting the credentials developers feed into AI coding tools, a soft spot as those tools spread across editors and IDEs.