Case aikido-jetbrains-ai-key-theftLLMjackingWorldwide
15 JetBrains Marketplace AI plugins with 70,000 installs steal OpenAI and DeepSeek keys
Aikido found at least 15 plugins from seven vendor accounts that acted as AI assistants but sent users OpenAI, DeepSeek and SiliconFlow API keys over plain HTTP to an attacker server; a paid tier gave out harvested keys.
HighAttack on AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 16, 2026
- Location
- Worldwide
- Target
- Developers using JetBrains IDE AI assistant plugins
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Aikido found at least 15 plugins from seven vendor accounts that acted as AI assistants but sent users OpenAI, DeepSeek and SiliconFlow API keys over plain HTTP to an attacker server; a paid tier gave out harvested keys.
Impact: Roughly 70,000 combined installs; DeepSeek AI Assist and CodeGPT AI Assistant alone had over 53,000 downloads.
Who triggered it
Actor: Unknown
Attribution: Aikido Security analysis of plugin code and exfil endpoint; operator identity unknown.
Motive: Harvesting and resale of paid AI API access
How it happened
Attack vector: Trojanized IDE plugins exfiltrating keys when users click Apply in settings
Root cause: Marketplace review did not catch key exfiltration; users pasted live keys into third-party plugins
Timeline
- First malicious plugins published
- New plugins still being published
- Aikido discloses to JetBrains and publishes; top plugins still listed
Response
Aikido advised rotating keys; JetBrains had not responded at publication.
Current status: Under investigation
Sources (open in a new tab)
- Aikido Security aikido.dev
- BleepingComputer bleepingcomputer.com
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
15 JetBrains Marketplace AI plugins with 70,000 installs steal OpenAI and DeepSeek keys. AI Threat Watch, case aikido-jetbrains-ai-key-theft, Jun 16, 2026. https://aithreat.io/cases/aikido-jetbrains-ai-key-theft/
Permanent link: https://aithreat.io/cases/aikido-jetbrains-ai-key-theft/