15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys
JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026 · Coding agent
What happened
Security firm Aikido Security discovered 15 malicious plugins on the JetBrains Marketplace that posed as AI coding assistants offering chat, commit messages, code review, bug finding and unit tests. Each functioned as advertised, but when a developer entered an AI provider API key into the plugin settings, it was silently forwarded over plain HTTP to an attacker-controlled server. Stolen keys covered OpenAI, DeepSeek and SiliconFlow. The two most-downloaded plugins, DeepSeek AI Assist and CodeGPT AI Assistant, reported over 25,000 downloads each, though Aikido noted counts can be inflated. The campaign ran from late October 2025 through June 2026.
Causal vector
Supply-chain compromise: trojanized AI coding plugins that delivered real functionality while exfiltrating stored API keys
Source
Reported by BleepingComputer. Verified against the primary report.
The plugin theft hijacks the developer's own AI spend: a stolen key means someone else's agents bill against the victim's account. A daily total and velocity limit on API-key spend caps the blast radius of any leaked key regardless of how it was stolen, and key rotation enforced at the policy layer is exactly the control sipi.bot gates.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack
LiteLLM (BerriAI) · Mar 24, 2026
Step Finance treasury drained in $27–40M exploit
Step Finance · Jan 31, 2026
TRM Labs: $2.87 billion stolen across ~150 crypto hacks in 2025
TRM Labs · Jan 1, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.