:

JETBRAINS MARKETPLACE PLAGUED BY 15 API KEY-STEALING PLUGINS

AI DESK1 MIN READ
WED, JUN 17, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

Researchers discovered at least 15 malicious plugins on the JetBrains Marketplace designed to steal AI API keys from developers. The plugins bypassed security checks and posed as legitimate development tools.

The malicious plugins targeted developers using popular JetBrains IDEs, including IntelliJ IDEA and PyCharm. They were engineered to extract API keys for services like OpenAI, Anthropic, and other AI platforms—credentials that could grant attackers access to expensive API services or sensitive project data. JetBrains removed the plugins after security researchers identified the threat. The incident highlights vulnerabilities in marketplace vetting processes and raises concerns about supply chain attacks targeting developer tools. Developers using JetBrains products should audit installed plugins and review API key exposure. Users should rotate compromised credentials immediately. JetBrains has not disclosed how long the plugins remained available or how many installations occurred before removal. This incident follows similar marketplace security incidents across platforms like VS Code and Chrome, underscoring the persistent risk of malicious extensions targeting developers.

■ SOURCES

Bleeping Computer

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

OpenAI inadvertently launched a denial-of-service attack against Hugging Face, the popular machine learning platform. The incident has prompted questions about AI infrastructure security and unintended consequences of large-scale operations.

7H AGOAI Desk

Framework's customer database was compromised in a data breach, though payment information was not exposed. The company has disclosed the incident to affected users.

8H AGODev Desk

Security researchers have identified potential hardware backdoors in certain x86 processors. The findings, detailed in a GitHub repository called Rosenbridge, reveal vulnerabilities at the processor level that could allow unauthorized access.

11H AGOIndustry Desk

Flock Safety, the traffic camera company, is expanding beyond law enforcement with plans to deploy dashcams in rideshare vehicles and offer coaching services to police departments.

11H AGOIndustry Desk

■ SUBSCRIBE TO THE DAILY BRIEF

ONE EMAIL, 5 STORIES, 06:00 UTC. UNSUBSCRIBE ANYTIME.