--- title: "JetBrains Marketplace Ecosystem Security Update: Addressing Malicious Third-Party AI Plugins" url: https://daily.dev/posts/jetbrains-marketplace-ecosystem-security-update-addressing-malicious-third-party-ai-plugins-r8dyuc6rt source_url: https://blog.jetbrains.com/platform/2026/06/marketplace-ecosystem-security-update-malicious-ai-plugins type: article source: "JetBrains" published: 2026-06-17T17:16:59.941Z updated: 2026-06-17T17:17:25.111Z tags: ["security", "jetbrains"] reading_time: 6 upvotes: 5 comments: 1 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # JetBrains Marketplace Ecosystem Security Update: Addressing Malicious Third-Party AI Plugins **[JetBrains](https://daily.dev/sources/jetbrains)** 路 6 min read 路 5 upvotes 路 1 comments ## Summary JetBrains disclosed a supply chain attack involving 15 malicious third-party plugins on JetBrains Marketplace that stole AI provider API keys (OpenAI, DeepSeek, SiliconFlow, etc.). The plugins posed as legitimate AI utilities, silently installed a JVM-wide X509TrustManager to bypass TLS warnings, then exfiltrated API keys as plaintext JSON to a hardcoded C2 IP address. JetBrains removed all 15 plugins, permanently banned 7 publisher accounts, and triggered a remote kill-switch to disable the plugins in users' IDEs. Affected developers should immediately revoke and reissue any API keys entered into these plugins, check provider dashboards for anomalous usage, and block the C2 IP. JetBrains is hardening its ingestion pipeline to flag raw HTTP endpoints, hardcoded IPs, and unauthorized TLS weakening. The post also recommends adopting the Agent Client Protocol (ACP) as a safer alternative to unsandboxed marketplace plugins. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@starfallcodes** 路 0 upvotes > Yipitty dippity, > > the server got hippity, > > the firewall got slippity, > > the secrets went trippity, > > the hackers got grippity... > > your ai api's are stolen 馃様馃摝 ## Similar posts on daily.dev - [15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers](https://daily.dev/posts/15-malicious-jetbrains-plugins-stole-ai-api-keys-from-70-000-developers-hledivprv) 路 StepSecurity 路 17 upvotes 路 5 comments - [Multiple JetBrains IDE plugins caught stealing AI keys](https://daily.dev/posts/multiple-jetbrains-ide-plugins-caught-stealing-ai-keys-e0cbtefum) 路 Aikido Security 路 32 upvotes 路 3 comments - [Malicious JetBrains Marketplace plugins steal AI API keys from developers](https://daily.dev/posts/malicious-jetbrains-marketplace-plugins-steal-ai-api-keys-from-developers-zb2atx1w4) 路 BleepingComputer 路 0 upvotes 路 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#jetbrains](https://daily.dev/tags/jetbrains) [View this post on daily.dev](https://daily.dev/posts/jetbrains-marketplace-ecosystem-security-update-addressing-malicious-third-party-ai-plugins-r8dyuc6rt)