Ages late, but useful for posterity:

mklink, dir, and friends are not executables; they are functions within CMD. To use them in a shell, you have to first invoke cmd.

cmd /c "mklink C:\bar"

which becomes:

winrs -r:foo "cmd /c "c:\bar""

This isn't a bug by any stretch of the definition. It is a design flaw. BrightKite changed the privacy model drastically and did not take the time and effort to properly reconcile the systems before going live. It's a mistake that will cost them a LOT of users, and a lot of the trust so many of us have put in them, but I'm glad they've put a tourniquet on the problem and hope they can resolve the issue, even if it takes a little time.

The number one thing I enjoyed about BK was the ability to share my message or photo with the world and use the privacy settings to control how accurate of a location the viewer could see. That was beautiful, genius even. Now I have to share exact location or no message at all? To me (and to many others) the location was more important privacy-wise than the content of the message, and the new BK does not reflect this at all. I'm disappointed.

data that had been posted private for trusted friends only (including exact places like home addresses) were suddenly publicly available, so yes it has done harm.