On March 19, 2026, a threat actor with the handle TeamPCP exploited a single misconfigured GitHub Actions workflow inside Aqua Security’s Trivy repository, one of the most trusted open-source vulnerability scanners in the world. They compromised a service account, force-pushed malicious code to 76 of 77 version tags, and quietly embedded a credential stealer into a tool that security teams around the world were actively using to protect themselves.

The payload harvested SSH keys, cloud tokens, Kubernetes secrets, and npm credentials from CI/CD environments. Those stolen tokens fueled CanisterWorm, a self-propagating worm that cascaded through 66+ npm packages using blockchain-based command infrastructure that couldn’t be conventionally taken down. Within eight days, the same campaign had compromised GitHub Actions, Docker Hub, npm, PyPI, and the VS Code extension marketplace. One misconfiguration. Five ecosystems. An estimated 300 GB of exfiltrated data. Over 500,000 stolen credentials.

The attacker didn’t write a zero-day. They didn’t break encryption. They turned a trusted security tool into a weapon, and most organizations never saw it coming.

This Isn’t Your Father’s Supply Chain Attack

The industry has been talking about software supply chain risk since SolarWinds in 2020. But something fundamental has shifted in the last twelve months.

The attack surface is no longer human-scale.

The average application ships with over 1,100 open-source components. Most of those were chosen by nobody on your team: they’re transitive dependencies, packages that your packages depend on. And increasingly, even first-order dependency decisions are no longer made by humans.

AI coding agents (Cursor, GitHub Copilot Workspace, Claude Code, and their descendants) are now writing code, selecting libraries, and opening pull requests without a human ever touching the keyboard. A study of over 117,000 dependency changes found that AI agents select known-vulnerable dependency versions 50% more often than humans. They do this at speeds that compress the security review window to essentially zero.

The same week as TeamPCP, attackers also compromised Axios (the HTTP library downloaded over 100 million times a week) by adding a malicious dependency that ran a remote access trojan on install, then self-destructed before anyone noticed. The industry average time to detect a supply chain breach is 267 days. On 135 monitored endpoints, that malware executed and phoned home to the attacker’s server within 89 seconds of install.

As a16z put it bluntly in their April 2026 analysis: “We are building a world where machines write the code, machines choose the dependencies, and machines ship the updates.” If security doesn’t keep pace, the AI agents are cooked.

The Three Attack Surfaces Nobody Is Defending

There are now three distinct attack surfaces that most security teams have almost no visibility into.

The developer machine. Developer machines are running MCP servers, AI models, IDE extensions, and browser plugins that directly influence what code gets written and committed. Credentials accumulate across dotfiles, .env files, and environment variables. Security teams typically have no real-time inventory of what’s running.

The coding agent. AI coding agents don’t just suggest code: they act. They install dependencies, invoke external tools via MCP servers, execute builds, and push commits. Most security policies were written for humans. There is no category in your existing tooling for “approve this MCP server plugin before the agent can use it.” Attackers are beginning to exploit this gap explicitly.

AI-generated code. LLMs regularly invent package names that don’t exist. Nearly 20% of AI-recommended packages are fabrications, and attackers register these hallucinated names in advance with malicious payloads. The technique is called “slopsquatting.” One researcher uploaded a dummy package with a commonly hallucinated name and watched it accumulate 30,000 downloads, largely from AI-driven workflows, in weeks.

Traditional security tooling is blind to all three surfaces. Most software composition analysis tools work by checking dependencies against CVE databases. But a newly planted backdoor doesn’t have a CVE. Running npm audit on the compromised Axios version returned a clean bill of health because the malware had already self-destructed.

Securing AI Development at the Source

This is the problem that Montreal-based Boost Security is built to solve. And why we at Amiral Ventures are proud to have backed them.

Boost Security’s core insight is deceptively simple: the right place to stop a supply chain attack is not the CI/CD pipeline gate. By the time code reaches your scanner, credentials may already be exfiltrated and your developer machine may already be compromised. You need to move protection upstream: to the moment a prompt is sent to a coding agent, to the moment a dependency is suggested, to the moment a plugin is installed.

Their newly launched Developer Endpoint Security platform gives security teams centralized visibility and governance across the full AI development workflow:

• Developer Endpoint Visibility: A real-time inventory of every coding agent, MCP server, AI model, IDE extension, and package running across your developer fleet, the exact visibility gap that made TeamPCP possible.

• Coding Agent Safety: Governance controls ensuring agents only run with approved MCP servers and plugins, with configuration drift flagged before it becomes an incident.

• Supply Chain Security: Behavioral analysis of packages and extensions: evaluating what code actually does, not just checking it against a CVE list.

• Secure Agentic Code Generation: Guardrails embedded into the coding agent workflow so generated code follows organizational secure coding guidelines before being committed.

• Data Leakage Prevention: Outbound prompt scanning to detect and mask credentials and API keys before they reach external LLMs.

“AI coding agents are fundamentally changing how software gets built, but security has largely remained focused on scanning code after the fact,” said CEO and Founder Zaid Al Hamami. “Developer Endpoint Security moves protection upstream. It secures the developer machine, governs the coding agent, and ensures safer code is generated from the start.”

Why We Invested

A few things stood out when we evaluated Boost Security at Amiral.

The team. Zaid co-founded the company alongside Rajiv Sinha, who built Oracle’s first Application Security program and later worked at Cigital, the leading North American AppSec consulting firm. This is Zaid's second software security startup. His first, Immunio, built the first RASP technology, and was acquired by TrendMicro. Between them, two decades of seeing every era of software security from the inside. Their VP of Security Research, François Proulx, is one of the founders of NorthSec and a veteran AppSec researcher who has discovered 0-days in Terraform providers, AWS Helm Charts, and major GitHub Actions; he’s a recognized voice in the supply chain security community long before most people knew it was a category.

The timing. The threat landscape shifted materially in the past 12 months. AI coding agents have moved from prototype to production infrastructure at thousands of organizations. The attack surface they create, developer machines running MCP servers, agents making autonomous dependency decisions, LLMs hallucinating package names, didn’t meaningfully exist two years ago. Boost Security is building for the world that actually exists now.

The market. After SolarWinds, Log4Shell, XZ Utils, TeamPCP, and the Axios attack, the CISO conversation has shifted from “should we care about this?” to “how do we actually defend against it?” The specific category of AI-native developer security (securing the coding agent workflow, not just the code it produces) is still early. There are very few credible solutions addressing all three attack surfaces described above. Boost Security is one of them.

What This Means for You

If you’re a CISO or AppSec leader, three questions worth asking your team today:

1. Do you have a real-time inventory of every AI tool, MCP server, and IDE extension running on your developer machines?

2. Do your security policies govern what AI coding agents can connect to and what packages they can install?

3. Are you checking packages for behavioral signals, or just CVE matches?

If the answers are uncertain, this is exactly the gap Boost Security is built to close.

Canada faces a choice: step forward into the world, or be left behind.

There is a narrative about Canada that has been repeated so often it has started to feel like fact. That we cannot win. That our ambitions must go south to be taken seriously. That world-changing ideas need to be built somewhere else. History says otherwise.

There is a call for the brave, for the self-believing, and for those willing to swim against stagnancy. There is a chance to prove that Canadians can win.

In our roots, there is resilience. Canada was not built on excess. It was built on persistence.

There Is a Pattern in Our Roots

In the winter of 1921, a young surgeon named Frederick Banting walked into a University of Toronto lab with an idea that most of the medical establishment thought was wrong. He had no research budget, no proper lab space, and no track record in endocrinology. He had ten dogs, a borrowed room, and eight weeks before the facility needed it back. Despite everything, he discovered something that changed the world forever.

One year later, a 14-year-old boy named Leonard Thompson was dying of diabetes in Toronto General Hospital. His blood sugar was sky-high. He had weeks, maybe days. The clinical team administered Banting’s discovery, insulin, for the first time in human history. Within hours, Leonard’s blood glucose fell to normal. He lived for another 13 years, long enough to see the discovery that saved him earn a Nobel Prize.

That story is not an exception in Canada’s history. It is the pattern: a small team, limited resources, enormous ambition, and a result that echoed across generations.

Canada tends to narrate its own story with excessive modesty. We celebrate our politeness and our stability. These are real virtues. But we have grown apologetic, underselling our capacity for bold, world-changing invention. We have lost our own self-belief, and with it, our capability.

The truth is more interesting. Canada has been building at the frontier, in medicine, space, computing, and energy, for centuries. Not as a follower. As a pioneer.

Building at the Frontier

In 1950, while researching hypothermia treatments, electrical engineer John Hopps at the National Research Council made an accidental discovery: a stopped heart could be restarted mechanically or electrically. He built the world’s first cardiac pacemaker. It was large, external, and needed to be plugged into a wall, but the principle was correct. Today, over three million people worldwide carry a direct descendant of Hopps’ invention inside their chests. Canada gave them another heartbeat.

In 1975, NASA invited Canada to contribute to its Space Shuttle program. What Canada brought was a robotic arm, the Canadarm, a 15-metre articulated manipulator that became the most complex construction tool ever deployed. Built by Spar Aerospace (now MDA Space) in Brampton, Ontario, it flew on 90 Shuttle missions between 1981 and 2011. It helped assemble the International Space Station. It serviced the Hubble Space Telescope five times. When astronaut Scott Parazynski needed to repair a torn solar array in 2007 while standing at the end of an extended boom 90 feet above the ISS, it was Canadian technology holding him there.

Canadarm2, launched in 2001, has been a fixture on the ISS ever since. It has captured over 50 visiting spacecraft, including SpaceX’s Dragon and Northrop Grumman’s Cygnus. MDA Space is now deep into building Canadarm3, an AI-powered autonomous robotic system destined for Gateway, NASA’s lunar-orbiting outpost. Canada’s reach is getting longer. We are going to the Moon.

These are not stories of Canadian ingenuity waiting for American permission. They are stories of builders called upon to solve problems no one else could and who delivered.

The Long Revolution in AI

In the 1980s, when virtually every major research institution in the world had abandoned neural networks as a dead end, a British-born researcher named Geoffrey Hinton chose Toronto. He came because Canada was willing to fund speculative, long-horizon research through the Canadian Institute for Advanced Research. Work that the rest of the world had decided wasn’t worth the risk.

For decades, Hinton in Toronto, Yoshua Bengio in Montreal, and Richard Sutton in Edmonton worked in what felt like academic obscurity. They were studying the mathematics of how the brain might learn. Their colleagues thought they were chasing ghosts. The field was called “deep learning,” and virtually no one believed it would amount to anything practical.

In 2012, Hinton’s lab at the University of Toronto entered the ImageNet competition, the world’s most-watched test of machine vision. They won by a margin so large that it didn’t just beat the competition, it ended the competition. Neural networks weren’t a dead end. They were the beginning. The modern AI revolution, ChatGPT, Gemini, Claude, and every large language model you’ve heard of, runs on architectures descended from work done in Toronto, Edmonton, and Montreal.

In 2018, Hinton, Bengio, and Yann LeCun shared the Turing Award, the Nobel Prize of computer science, for their foundational contributions to deep learning.

Canada did not stumble into AI leadership. It invested in it patiently, for decades, when no one else would. Mila, the Quebec AI Institute co-founded by Bengio at Université de Montréal, is now the largest academic deep learning research centre in the world, with over 1,400 specialized researchers. The Vector Institute in Toronto, co-founded by Hinton, hosts over 1,000 researchers. Together with Amii in Edmonton, these three institutes form a national AI infrastructure that other countries are still trying to replicate.

This is what Canadian patience, ambition, and public investment can produce. Not a fast flip. A foundation that changed the world.

From Research to Runway

Canada’s innovation has not stayed in the lab. Shopify began in Ottawa in 2006 when Tobi Lütke, frustrated by the state of available e-commerce software, built his own. It now powers approximately 5 million stores globally, with a market capitalization of over $200 billion. Lütke, when asked why he hasn’t moved to the United States, replied simply: “Because I like Canada.” In a period when Canada’s sovereignty is under real external pressure, those four words became a rallying cry.

Cohere, founded in Toronto in 2019 by Aidan Gomez, Ivan Zhang, and Nick Frosst, has become the country’s flagship enterprise AI company. When a large US firm offered to acquire them at a nine-digit price, the founders refused. Today, Cohere is valued at over $7 billion, with revenue growing more than three times over in 2025. CEO Aidan Gomez was direct about why: “I really feel that our country is under threat. I feel that the box of Canada’s sovereignty has been opened, and it can’t be closed.” That is not the language of a startup pitch. That is the language of a builder who understands what is at stake.

Waabi, founded by Raquel Urtasun, who previously led Uber’s self-driving research, is taking a simulation-first approach to autonomous trucking, training its AI in virtual environments rather than running millions of potentially dangerous road miles. Backed by Uber and Khosla Ventures, Waabi began deploying fully driverless trucks in 2025.

Then there is Reaction Dynamics, a Montreal-based rocket propulsion startup building Canada’s capacity to reach orbit independently. A small team, few resources, a hard technical problem, and a mission tied directly to national sovereignty. Canadian Dynamism in practice.

The Unifying Thread

Banting worked on borrowed time in a borrowed lab. Hopps was researching something entirely different when he found the pacemaker. The Canadarm was Canada’s entry ticket to the Space Shuttle program, pragmatic, collaborative, and technically extraordinary. Hinton and Bengio funded deep learning research through Canadian institutions for decades before the world recognized what they had built.

Canadian innovation tends to be long-term. It tends to be patient. It tends to emerge from people willing to work on hard problems, in unglamorous conditions, for timelines that nobody else believes in. It does not tend to be loud. That is both its strength and its weakness.

The strength: Canadian builders build things that last. Insulin. The pacemaker. The Canadarm. Shopify. The foundation of modern AI.

The weakness: We have been better at invention than ownership. We discovered insulin and sold the patent for one dollar each. We conceived the light bulb and sold it to Thomas Edison. We built some of the most important technologies of the 20th century and watched the commercial value accrue abroad. The world benefited, but Canada did not always capture what it created. A sapling that dies before it has the chance to develop its own strength is lost potential. We forced our greatest inventions to move to survive.

Canada needs to start owning, protecting, supporting, and being proud of what makes it great.

The Moment We Are In

The external pressure Canada faces, economic, geopolitical, and technological, is real. But it is also an invitation. An invitation to stop outsourcing our ambition. To stop equating “not losing” with winning. To remember that we have grown world-changing inventions in the fields where no other crops could survive.

The resources were never lavish. Capital has been leaving quietly for two decades. In 2005, Canada’s largest pension fund held 74% of its investments at home. Today it holds 12%. The builders have noticed.

The next generation of builders in AI, in space, energy, defence, biotech, and climate, are not starting from scratch. They are standing on the shoulders of Canadian resilience. On Banting, Hopps, Hinton, and Bengio. They are inheriting a tradition of patient, rigorous, and frontier-facing work that has quietly shaped the modern world.

They need capital that leads, not follows. They need investors willing to sit with hard problems and long timelines. They need an ecosystem that treats ambition as a Canadian value, not an export. Building here is not a consolation prize. It is the point.

There is an opportunity to triumph. We have struggled long enough. Winter is over.

What Canadian Dynamism Means

American Dynamism is explicitly about the national interest, building for America, strengthening America, and making America more competitive. That is a worthy and coherent philosophy.

Canadian Dynamism is something different. It has always been oriented outward. Banting didn’t sell insulin to Canadians. He gave it to the world for a dollar. The Canadarm didn’t build a Canadian space station. It built humanity’s. Hinton and Bengio didn’t create AI for Canada’s benefit. They published their research openly, and the entire world built on top of it.

That is the Canadian instinct: to build things so good and so fundamental that the world cannot do without them. Not to win at the expense of others. To build in a way that makes everyone better off and to be indispensable because of it.

It means backing founders solving hard problems. It means recognizing that resilience of supply chains, infrastructure, sovereignty, and health systems is not a niche thesis. It is the defining challenge of the next decade. It means understanding that the country which built the tools that assembled the International Space Station, gave the world insulin, and quietly invented the foundation of modern AI, is not a country that needs to apologize for its ambitions.

It means building flagships. Not subsidiaries. Not branch offices. Not features inside external platforms. Companies of global scale, owned and led from Canada, solving problems that matter and keeping the value at home.

The Canadian Moat

Dynamism is resilience, a deep patience for difficult problems, combined with a certainty that through hard work, the problem will yield. Patience is the Canadian moat.

Banting didn’t give up when the university laughed at his proposal. Hinton didn’t give up when the field of neural networks was effectively declared dead. MDA didn’t stop building after the Canadarm. They built Canadarm2, then Dextre, and now Canadarm3.

That is the spirit. The one still standing when the problem finally yields.

Canada has always been a nation of builders. We built at the frontier of medicine when it was dangerous and speculative. We built at the frontier of space. We built the intellectual foundations of AI when the rest of the world thought it was a waste of time. We are now building autonomous systems for the Moon, enterprise AI companies with billion-dollar valuations, and rocket propulsion for sovereign access to orbit.

The pattern is clear. The capacity is real. The question is whether the next generation of builders will be supported, with capital, community, and conviction, to build at the scale Canada is capable of.

The future must be claimed. There are flagships to be built.

Ethan Marcoux is a writer and researcher focused on Canadian technology and defence innovation, and the founder of The Canadian Explorers publication.

Amiral Ventures is a Montreal-based seed and pre-Series A venture fund backing Canada’s most ambitious founders in AI-native enterprise software, resilience, and sustainability.