Assumed Safe. The AI, Privacy, and Security Weekly Update for the Week Ending May 5th, 2026.

Episode 290. This week, we assume nothing in our collection of stories...A flaw hiding in plain sight for nearly a decade has quietly turned every Linux system's most trusted layer into an open door.Attackers have discovered that the easiest way to install malware is to convince users the malware is the cure.A new phishing kit is lowering the barrier to industrial-scale credential theft to roughly the cost of a Netflix subscription. Ransomware didn't slow down in Q1 2026  it mutated, and the new strain doesn't even need encryption to extort you.Credit Union Loan Fraud The most methodical fraud playbook circulating underground right now doesn't involve a single line of malicious code.A teenager with a forum alias just handed a third of France's population an identity problem they didn't ask for.Six of the world's most serious cybersecurity agencies just issued a unified warning that most organizations deploying agentic AI are not ready for what they've built.A new paper argues that the discipline meant to stress-test AI safety has itself become the thing it was designed to find a vulnerability dressed up as a control.The arc runs from infrastructure to brand to process to institution to the security function itself. Each story is a different flavor of the same failure: someone trusted something they shouldn't have, or built a system that assumed others would.Let's go verify!Find the full transcript to this podcast here.