top of page

How 15 Malicious JetBrains Plugins Stole API Keys from 70,000 Developers - The Dev Team Checklist to Contain, Rotate, and Harden Secrets

The JetBrains plugin incident in June 2026 is not just another security headline. It is a clear warning that AI adoption inside developer workflows has outpaced plugin governance in many organizations.

For engineering leaders, this is a high-priority shift in risk. The attack path was simple and effective: developers installed seemingly useful AI plugins, entered provider API keys, and those keys were silently exfiltrated. The immediate lesson is practical - teams now need a concrete, repeatable process for IDE extension security, secret hygiene, and safer AI integration patterns.


What happened - and why it changes the threat model


JetBrains reported on June 17, 2026 that it removed 15 malicious third-party plugins from the Marketplace, banned related publisher accounts, and remotely disabled the plugins in affected IDE installations. The plugins were built to steal AI provider API keys entered by users.

External reporting and research reinforced the scope and timing:

  • The campaign reportedly ran from late October 2025 through June 2026

  • The malicious plugins were distributed under multiple publisher accounts

  • Public reporting placed total installs around 70,000

  • New malicious entries were still appearing in June 2026, shortly before discovery

This matters because it confirms a mature pattern:

  • Plugins can be functionally useful and still malicious

  • Marketplace presence does not equal deep code trust

  • AI keys are now a high-value target because they map directly to paid usage and model access


How the credential theft worked in practice


The reported behavior followed a repeatable sequence:

  • User enters AI key in plugin settings

  • User clicks Apply

  • Plugin forwards the key to attacker infrastructure

  • Exfiltration used a hardcoded endpoint tied to 39.107.60.51

  • Traffic was sent via plaintext HTTP, not secure HTTPS

  • Similar code patterns appeared across all identified plugins

Security write-ups also described a “donation wall” model where paying users could receive a key from the backend, suggesting potential credential redistribution and downstream abuse.

From a security architecture perspective, this is a classic supply-chain pattern adapted for AI tooling:

  • Trusted distribution channel

  • Low-friction credential entry

  • Silent data movement

  • Delayed detection


API-key safety checklist for dev teams right now


Treat this as an operational response plan, not a one-time cleanup.


Immediate containment (today)


  • Remove suspicious or unapproved AI plugins from all JetBrains IDEs

  • Assume any key entered into affected plugins is compromised

  • Revoke and reissue keys across providers (OpenAI, DeepSeek, SiliconFlow, others)

  • Block known malicious infrastructure (39.107.60.51) at network and endpoint layers

  • Review provider usage dashboards for abnormal spikes, unfamiliar patterns, and billing anomalies


Secret hygiene hardening (this week)


Apply key-safety controls consistently across all developer projects:

  • Never embed API keys in client-side apps, browser contexts, or plugin code

  • Never commit keys to repositories

  • Use environment variables instead of hardcoded secrets

  • Prefer a key management service for production workloads

  • Use individual keys per team member, not shared credentials

  • Rotate keys immediately after any suspected exposure

  • Restrict API access with IP allowlisting where supported

  • Enforce least privilege: scoped keys, model restrictions, spend caps


IDE/plugin governance (this month)


Move from ad hoc installs to policy-driven controls:

  • Maintain an approved plugin allowlist by team and IDE

  • Add periodic plugin audits to security reviews

  • Track extension inventory across developer endpoints

  • Add detections for unusual IDE-originated outbound traffic

  • Require security sign-off for plugins that request or process credentials

  • Include plugin risk in onboarding and secure coding training


Safer AI integration pattern: reduce trust in arbitrary plugins


A key forward-looking option is to standardize AI agent integration through the Agent Client Protocol (ACP), supported by JetBrains and Zed.

Why this is strategically useful:

  • ACP introduces a shared interface between IDEs and agents

  • It reduces one-off custom integration logic in opaque plugins

  • It supports local, remote, and in-house agents

  • It helps teams enforce centralized controls around which agents are allowed

JetBrains documentation for WebStorm shows practical enterprise-relevant capabilities:

  • Install agents from a curated registry

  • Add custom agents via explicit acp.json configuration

  • Manage agent lifecycle (install/update/uninstall)

  • Collect ACP logs for troubleshooting and investigation

  • Configure agent runtime and environment with clearer operational control

Important caveat: even with protocol-based integration, secrets still require strict handling. The right model is defense in depth - controlled integration plus strong secret management plus active monitoring.


Building a durable response, not a reactive fix


The main takeaway is straightforward: developer AI tooling is now part of your production security perimeter. Organizations that treat IDE extensions as low-risk productivity add-ons will continue to absorb preventable key theft and cloud-cost abuse.

The stronger approach is to combine:

  • Fast incident response (remove, revoke, rotate, monitor)

  • Governed plugin operations (allowlists, audits, detection)

  • Safer integration architecture (standardized agent protocols)

  • Secret lifecycle discipline (least privilege, KMS, rotation, restrictions)

Teams that institutionalize this checklist now will move faster with AI and with less operational risk in the next wave of tooling incidents.


Sources


bottom of page