Plugins masquerading as AI utilities silently harvested API keys via custom TLS disablement and unencrypted HTTP exfiltration to hardcoded C2 IPs—JetBrains remotely disabled all 15 and is hardening Marketplace ingestion rules.
Summary
If you use third-party AI plugins in JetBrains IDEs, any API keys entered before June 17, 2026 are compromised. You must revoke credentials immediately and audit provider logs for unauthorized usage, then shift to sandboxed alternatives like ACP-registered agents.
Why it matters
If you use third-party AI plugins in JetBrains IDEs, any API keys entered before June 17, 2026 are compromised. You must revoke credentials immediately and audit provider logs for unauthorized usage, then shift to sandboxed alternatives like ACP-registered agents.
Implementation verdict
Replaces trust in Marketplace verification badges with mandatory manual plugin audits and credential rotation. Requires: revoke all API keys used in plugins, scan repos for exposed credentials, block C2 IP 39.107.60[.]51 at firewall level, adopt ACP protocol for future AI integrations. Act now—this is confirmed, not speculative.
Sources
Dev Signal
Get briefs like this in your inbox — free, every weekday.
100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.