I kinda disagree with the context comment though. That era of computing was inherently wild - nobody had figured anything out yet beyond the most basic and general strokes, and security analysts (such as they were) had what would be considered a childish understanding of IT security by modern standards. Heck, Windows95 didn’t even have the TCP stack enabled by default, so when these features were being designed, planned, and coded at Microsoft, there was no context for security on that kind of feature. Wikipedia says that Win95 was in the planning stage in 1992 - I take that with a grain of salt, but the concept is valid. Microsoft was writing the core features of Windows 95 before WAN was even really a thing. Like I said, I don’t disagree with the idea that AutoRun was a terrible thing among many terrible things Microsoft is responsible for, but given the era in which AutoRun came out, it was a reasonable trade-off between security and functionality for the lowest common denominator of user. The whole thing should have been disabled (on 95 and 98) when Windows 98 came out since they should have known better at that point.