JetBrains Marketplace plugins silently steal AI API keys from thousands of developers
Security researchers found 15 JetBrains Marketplace plugins that silently harvest AI service API keys and ship them to a malicious server, exposing up to 70,000 developers to credential theft. The plugins, masquerading as AI assistants, have been active since Oct 2025 and continue to be released, turning the IDE ecosystem into a new supply‑chain attack vector.