In what security researchers are calling one of the most sophisticated software supply chain attacks of 2026, JetBrains confirmed on June 16 that 15 third-party plugins available on its Marketplace had been secretly harvesting AI provider API keys from developers since October 2025 — a period of over eight months during which tens of thousands of developers were unknowingly compromised.

The attack was chillingly effective in its design. The malicious plugins, including two with over 25,000 downloads each — CodeGPT AI Assistant and DeepSeek AI Assist — appeared fully functional and delivered exactly the features they advertised. Developers had no reason to suspect anything was wrong. The plugins worked as expected, received positive reviews, and accumulated substantial install counts across JetBrains' ecosystem of development environments including IntelliJ IDEA, PyCharm, and WebStorm.

The attack mechanism was precise and technically sophisticated. When a developer entered their AI provider API key into the plugin's configuration settings and clicked the Apply button, the plugin simultaneously executed an unauthorized backend function. This function transmitted the key as a plaintext JSON payload over unencrypted HTTP to a hardcoded command-and-control IP address. To prevent detection and suppress browser or IDE security warnings, the plugins silently installed a JVM-wide X509TrustManager that disabled standard TLS certificate validation warnings, effectively blinding the developer environment to the exfiltration occurring in the background.

The keys stolen represented credentials for virtually every major AI provider: OpenAI, Anthropic, DeepSeek, Google Gemini, and several others. For organizations relying on these API keys for production workloads, the compromise is catastrophic. Stolen API keys can be used to run expensive inference jobs at the victim's expense, access proprietary data sent to AI APIs, or pivot to other organizational systems if the same credentials are reused.

The incident exposes a critical and underexplored gap in enterprise security programs: IDE plugin governance. Most organizations have robust controls around software package dependencies — tools like SCA scanners monitor open-source libraries for vulnerabilities — but developer tooling ecosystems like IDE plugins typically operate outside these controls. A developer installing a plugin operates with the same trust level as an administrator deploying enterprise software, but with almost none of the scrutiny.

Security teams are now scrambling to audit their environments. The recommended immediate actions include rotating all AI provider API keys, auditing installed JetBrains plugins across the development environment, implementing network monitoring for unexpected outbound connections from developer workstations, and establishing formal IDE plugin approval processes equivalent to those applied to open-source software dependencies.