Malicious JetBrains AI Plugins Stole Developer API Keys
At least 15 JetBrains plugins posed as AI assistants while stealing provider credentials. The campaign shows why developer tooling needs central governance and short-lived secrets.
Security company Aikido reported a coordinated set of malicious plugins in the JetBrains Marketplace. The plugins presented themselves as AI coding assistants or integrations while collecting API keys for services such as OpenAI, Anthropic and other model providers.
Researchers identified at least 15 related plugins, with the campaign beginning in October 2025 and new activity continuing into June 2026. Combined installation figures suggested that as many as roughly 70,000 installations could have been exposed, although an installation count does not prove that every system was active or every key was stolen.
The IDE is a privileged application
An IDE sees source code, project files, local environment variables, terminal sessions and authenticated developer services. A plugin that runs inside it may inherit far more useful context than a standalone desktop application.
AI plugins make the trust problem sharper. Users expect them to read code and connect to external model APIs, so network traffic and credential access can appear consistent with the promised function. A malicious plugin can hide inside normal behaviour.
Inventory first, then rotate
Organisations should collect installed plugin IDs, publishers, versions and installation times across managed developer devices. Search for the affected indicators published by the researchers and remove malicious packages, but do not stop there.
If a suspect plugin ran, assume that accessible API keys may have been copied. Response should include:
- revoke and replace model-provider and other exposed tokens;
- review provider logs for unusual usage, models, locations and spending;
- inspect source-control, cloud and package-registry credentials available to the IDE;
- preserve endpoint and network evidence;
- check for persistence outside the plugin directory;
- review prompts or source fragments that may have been sent externally.
Monitor billing closely. A stolen AI key can produce rapid cost as well as data exposure.
Govern plugins as executable dependencies
Marketplace review reduces risk but does not transfer accountability. Create an approved-plugin catalogue for managed development environments and block unreviewed installation where the risk justifies it.
Review should consider publisher identity, ownership changes, update behaviour, source availability, requested capabilities, outbound destinations and maintenance history. Pin or stage updates for high-risk extensions so a compromised publisher cannot immediately reach the entire fleet.
Developers still need a route to request new tools quickly. A policy that takes weeks will be bypassed; a lightweight security review and isolated trial environment are more sustainable.
Remove long-lived keys from the workstation
Developer tools should use individual, scoped and expiring credentials wherever providers support them. Central gateways can enforce model policy, redact selected data, cap spend and keep provider keys away from endpoints. Do not put one shared production key into every IDE.
The campaign succeeded because a plugin looked like a useful shortcut inside a trusted marketplace. The durable response is to make developer extensions visible, constrain what they can reach and ensure that stealing one key does not create lasting access.
