AI Security Incident Case: Jetbrains Plugin Supply Chain Attack Stealing AI Key

Overview In June 2026, the security research team Aikido detected a batch of collaborative malicious plugins in the JetBrains plugin market, totaling 15 plugins with nearly 70,000 cumulative installations. All of them would silently leak the AI service provider’s API key to the attacker’s server at the moment when the user saved it. This batch of plugins uses large language models such as DeepSeek and OpenAI as selling points, providing common development…

Diamond Model