https://arxiv.org/abs/2007.02220
Although our own work shows Copilot is pretty good at adding security flaws on its own:
https://arxiv.org/abs/2108.09293