Exactly. It seems like it has a lot of potential for things to go wrong. I can imagine the system flagging all sorts of valid software as malware for various

Exactly. It seems like it has a lot of potential for things to go wrong. I can imagine the system flagging all sorts of valid software as malware for various reasons and failing to flag actual malware that does not meet whatever inscrutable criteria the ML model uses. Systems like this seem like a good idea on paper, but without some basic controls like a whitelist / safelist it invites all sorts of trouble.