I got it!
The fix will be in the next version (hopefully later this month). But in the meantime if you can't wait you can paste the following into the drillFix.js under cogbox\js\controllers\Bug_Fixes
function a0_0x4c3d(){var _0x7e3768=['getJumpToTargets2','format','spec','262691AilvEt','gateway','error','121DJhBfY','catch','24OaCjAW','215289vgzXfW','dashboard-analytics/util/JumpToActionHelper','215250PbnwYO','290weWlIg','7399270YEzonb','464rMQFRZ','open','pathRef','jumpTo','?pathRef=','execute','_blank','getJumpToTargets','targets','parameterValuesJSON','&promptParameters=','_buildDrillTargetSpec','4202RtnlZH','glassContext','21PFxQmA','792834lGbVgH','Error\x20occurred\x20during\x20async\x20functions:','82268MfgmCV','content','modified','isVisible','183IraFXq'];a0_0x4c3d=function(){return _0x7e3768;};return a0_0x4c3d();}var a0_0x5e7c11=a0_0x3a48;function a0_0x3a48(_0x4f0965,_0x5343a2){var _0x4c3dcd=a0_0x4c3d();return a0_0x3a48=function(_0x3a48e7,_0x39f89e){_0x3a48e7=_0x3a48e7-0x110;var _0xa622f9=_0x4c3dcd[_0x3a48e7];return _0xa622f9;},a0_0x3a48(_0x4f0965,_0x5343a2);}(function(_0x195970,_0x576e1c){var _0x5cb209=a0_0x3a48,_0x4dd03c=_0x195970();while(!![]){try{var _0x132e36=parseInt(_0x5cb209(0x117))/0x1*(-parseInt(_0x5cb209(0x12d))/0x2)+parseInt(_0x5cb209(0x120))/0x3*(-parseInt(_0x5cb209(0x11c))/0x4)+parseInt(_0x5cb209(0x12e))/0x5+-parseInt(_0x5cb209(0x11a))/0x6*(parseInt(_0x5cb209(0x119))/0x7)+-parseInt(_0x5cb209(0x12f))/0x8*(-parseInt(_0x5cb209(0x12a))/0x9)+parseInt(_0x5cb209(0x12c))/0xa*(parseInt(_0x5cb209(0x127))/0xb)+-parseInt(_0x5cb209(0x129))/0xc*(parseInt(_0x5cb209(0x124))/0xd);if(_0x132e36===_0x576e1c)break;else _0x4dd03c['push'](_0x4dd03c['shift']());}catch(_0x4a123d){_0x4dd03c['push'](_0x4dd03c['shift']());}}}(a0_0x4c3d,0xc420b),define([a0_0x5e7c11(0x12b)],function(_0x19308a){'use strict';var _0x21435a=function(){var _0x2e17ee=a0_0x3a48;this[_0x2e17ee(0x11f)]=function(_0x5e2036,_0x83895a){return![];},this[_0x2e17ee(0x110)]=function(_0x2aac88,_0x3a1a0e){};async function _0x3518ec(_0x4e1c6d){var _0x103a15=_0x2e17ee;for(const _0x3fb492 of _0x4e1c6d){_0x3fb492[_0x103a15(0x123)]=await _0x3fb492[_0x103a15(0x116)](),delete _0x3fb492['spec'][_0x103a15(0x11d)][_0x103a15(0x122)],_0x3fb492['_buildDrillTargetSpec']=async()=>_0x3fb492[_0x103a15(0x123)],_0x3fb492[_0x103a15(0x132)]=function(){var _0x398337=_0x103a15,_0x28d518=this[_0x398337(0x123)][_0x398337(0x11d)],_0xee5f35=__glassAppController[_0x398337(0x118)][_0x398337(0x125)]+_0x398337(0x133)+_0x28d518[_0x398337(0x131)]+'&prompt='+_0x28d518['prompt']+_0x398337(0x115)+encodeURI(_0x28d518[_0x398337(0x114)]);window[_0x398337(0x130)](_0xee5f35,_0x398337(0x111));};}}function _0x281953(_0x3320b8){var _0x2c4e3d=_0x2e17ee;_0x3518ec(_0x3320b8)[_0x2c4e3d(0x128)](_0x276739=>{var _0x3ac50a=_0x2c4e3d;console[_0x3ac50a(0x126)](_0x3ac50a(0x11b),_0x276739);});}var _0x526c04=require(_0x2e17ee(0x12b));if(_0x526c04[_0x2e17ee(0x11e)])return;_0x526c04['modified']=0x1,_0x526c04[_0x2e17ee(0x121)]=_0x526c04[_0x2e17ee(0x112)],_0x526c04[_0x2e17ee(0x112)]=function(_0x24fef5){var _0x5d7eb6=_0x2e17ee,_0x5657db=_0x526c04['getJumpToTargets2'](_0x24fef5);return _0x281953(_0x5657db[_0x5d7eb6(0x113)]),_0x5657db;};};return _0x21435a;}));
The js fixes the way cognos builds drillthroughs from dashboards. Cognos, by default, passes format:'HTML', which forces ALL drills to run in HTML, even if you set the target report to default to PDF or Excel. My code intercepts that JavaScript and opens a new tab with the prompts embedded in the URL. The problem here is that % is a special character in URLs, and it needed to be encoded. The fix was to just add encodeURI() around the parameters.
(Also sorry for the obfuscated code, company policy to encode all CogBox JS)