Researchers broke GitHub Copilot’s safety by hiding harm in a workflow — Blankdot