BlogPrompt Injection Is Stealing API Keys From Claude Code, Gemini CLI, and GitHub CopilotApril 18, 2026