Home/ Incident database/jetbrains-plugin-key-theft-2026-06
Data breach Credential compromise verified

15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys

JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026 · Coding agent

What happened

Security firm Aikido Security discovered 15 malicious plugins on the JetBrains Marketplace that posed as AI coding assistants offering chat, commit messages, code review, bug finding and unit tests. Each functioned as advertised, but when a developer entered an AI provider API key into the plugin settings, it was silently forwarded over plain HTTP to an attacker-controlled server. Stolen keys covered OpenAI, DeepSeek and SiliconFlow. The two most-downloaded plugins, DeepSeek AI Assist and CodeGPT AI Assistant, reported over 25,000 downloads each, though Aikido noted counts can be inflated. The campaign ran from late October 2025 through June 2026.

Loss / impact
Jun 10
2026
Credential
Failure mode
Coding
Agent type

Causal vector

Supply-chain compromise: trojanized AI coding plugins that delivered real functionality while exfiltrating stored API keys

Source

Reported by BleepingComputer. Verified against the primary report.

Read the original report ↗

How a spend firewall would have helped

The plugin theft hijacks the developer's own AI spend: a stolen key means someone else's agents bill against the victim's account. A daily total and velocity limit on API-key spend caps the blast radius of any leaked key regardless of how it was stolen, and key rotation enforced at the policy layer is exactly the control sipi.bot gates.

The six rule types that contain this class of failure

Per-transaction cap

Any single spend above your ceiling is BLOCKED before it moves.

Daily total

Cumulative spend across all agent calls, bounded per day.

Velocity limit

Stops runaway retry loops — the #1 cause of overnight losses.

Merchant allowlist

Only approved destinations can ever receive funds.

Category rules

Flag high-risk classes (crypto, infra, refunds) for review.

Approval threshold

Above a value, the action waits for a human.

Related incidents

Don't be the next entry

Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.