AI CLI First-Run Traps: A Date-Pinned Nine-CLI Census

The AI CLI first run is the one moment where you have made no deliberate choice at all — and it is exactly where coding agents differ most. Before your first real prompt, a CLI may have asked you to trust a folder, defaulted a telemetry answer, written a device-identifier file to your home directory, and decided what the Enter key does while an agent is mid-task. This census pins down those behaviours for nine CLIs, each cell tied to a source read on August 24, 2026.

The stakes are concrete. A confirmed Cursor CLI flaw let a hostile repository execute arbitrary commands before the trust prompt ever appeared. aider’s opt-in analytics prompt brackets its default as [Yes], so the reflex keystroke that dismisses every other dialog opts you into telemetry. And pressing Enter while an agent works queues your message in one CLI and interrupts the turn in another — the same key, opposite defaults.

Just as important is what could not be established. For several of these tools, a security-conscious adopter cannot determine from the vendor’s own documentation what happens on first run. That gap is not padding to hide — it is a headline result of this census, and it gets its own section and its own column value below.

This census owns one life-cycle moment: what a CLI does before the user has made a single deliberate choice. Two sibling censuses already cover the neighbouring territory, and this post cross-links them rather than restating them. Headless and unattended permission defaults — what happens when nobody answers a prompt — belong to the headless-permissions census. Retention windows, training defaults, and opt-out mechanics belong to our census of what each vendor’s data terms actually say. Here, we only note that a toggle exists and how it is surfaced at first launch.

Four dimensions were checked for each CLI: the folder or workspace trust prompt (wording, default option, what it gates), telemetry and terms-of-service consent mechanics at first launch, composer behaviour when you type while the agent is already working, and what gets written to disk outside the project directory. The discipline is borrowed from the same dated-source-or-nothing method we used for the SSRF-validation census: every cell traces to a dated source retrieved on August 24, 2026, and any cell that could not be settled from those sources reads “not documented” — never a guess extrapolated from a sibling tool’s behaviour.

The matrix below is the census. Rows are grouped by how much of the first-run story the vendor actually documents, leading with the CLIs whose behaviour is established from primary sources. A cell marked “Not documented” means the dimension could not be settled from the vendor’s documentation or public trackers in this pass — it does not mean the mechanic is absent.

Counting across the matrix: a folder or workspace trust prompt is confirmed for five of the nine CLIs — Claude Code, Codex CLI, Cursor CLI, Qwen Code (where the gate ships disabled), and Antigravity (single-sourced). One CLI ships its trust gate off by default, one carried a now-patched pre-trust code-execution flaw, and one — Kimi CLI — has no first-run mechanic confirmed from primary sources on any of the four dimensions.

The most important result of this census is not any single trap — it is that for several of these tools, a security-conscious adopter cannot determine, from the vendor’s own documentation, what the tool does on first run. That is worth stating plainly because the temptation in comparison content is to paper over unknowns with plausible guesses borrowed from a sibling tool. We did the opposite: absence of documentation is recorded as data.

What was searched: for ZCode, the vendor’s documentation site including its welcome and FAQ pages; for Kimi CLI, the official getting-started guide plus release coverage; for Gemini CLI, the terms-of-service and privacy notice plus the telemetry and observability documentation; for Antigravity, Google’s own CLI usage page plus tutorial coverage. All retrieved August 24, 2026.

The trend this reveals is uncomfortable for the category: first-run behaviour is treated as an implementation detail rather than a contract. Vendors document their settings surface exhaustively once you are inside the tool, but the moment where defaults act on your behalf — before any setting has been read — is the least-described moment in the product. The tools with the most mature trust documentation, Qwen Code among them, are not necessarily the ones with the safest defaults; Qwen documents its trust mechanics in detail while shipping the entire gate disabled.

Projecting forward, we expect this gap to close the way the permission-defaults gap did: through incident write-ups rather than proactive documentation. Cursor’s pre-trust execution flaw produced more public detail about its first-run sequence than its own docs had — a pattern worth assuming will repeat. Until then, the practical rule is simple: a CLI whose first-run behaviour is undocumented should be treated as untrusted by default, run first in a throwaway directory on a clean git tree.

Claude Code’s prompt is the canonical shape: “Do you trust the files in this folder?” with “Yes, proceed” highlighted and Enter confirming it. Two public issues document the prompt re-firing for the same directory on certain setups — an annoyance that trains exactly the wrong reflex, since a prompt you have dismissed five times is a prompt you stop reading. Anthropic’s terms consent, meanwhile, is not an in-terminal step at all: it rides the browser-based /login flow, and a terms update can block CLI use with an error directing you to accept on the web first.

Codex CLI’s prompt leads with reassurance — “Since this folder is version controlled, you may wish to allow Codex to work in this folder without asking for approval” — and hides a genuine side effect: selecting the cautious request-approval option silently disables loading custom skills from the project’s .codex/skills directory, an undocumented consequence surfaced only through a community issue. Trust state lands in ~/.codex/config.toml, and an untrusted project’s local config, hooks, and rules are ignored entirely.

Qwen Code is the inversion: the most thoroughly documented trust model in the census — a four-option dialog, a central ~/.qwen/trustedFolders.json store, an explicit priority order — attached to a gate that ships disabled. Unless you enable security.folderTrust yourself, no dialog appears and none of the untrusted-mode restrictions apply. Most secondary coverage of Qwen’s trust mechanics misses that the default state is off.

aider is the clearest documented instance of the Enter-accepts-consent pattern in this census — and, to its credit, the most transparent about its analytics model overall. The docs state that analytics are collected only if you agree and opt in, and that code, prompts, chats, and keys are never collected. But the prompt itself brackets its default as [Yes]:

A reflexive Enter — the keystroke every other dialog in a terminal workflow has trained — opts you into telemetry inside a flow the documentation frames as opt-in. Two mitigating details: declining permanently disables analytics for that install, and only a randomly selected subset of users is ever asked at all, which means most aider first runs never surface a telemetry decision in either direction. Session and permanent flags (--no-analytics, --analytics-disable) exist for scripted setups.

Elsewhere the pattern is not a prompt but an absence of one. Claude Code surfaces no in-terminal telemetry decision; a June 2026 independent write-up documents a family of environment variables that disable analytics, error reporting, and non-essential traffic — we have not re-verified that list against the current settings reference, so treat the specifics as that write-up’s account rather than settled fact. The same write-up notes two structural details worth knowing regardless: opting out of telemetry stops Claude Code fetching remote experiment gates, which can change available features, and the WebFetch domain-safety check keeps sending hostnames to Anthropic regardless of telemetry settings.

Codex CLI ignores the telemetry key in project-local config entirely — the setting must live at user level, so a cloned repository cannot flip telemetry for the people who clone it. And consent at first login can be broader than the CLI itself: on individual ChatGPT plans, content may be used for training unless you opt out via the account-level privacy portal — a separate toggle from anything the CLI shows you. The retention and training specifics belong to the data-terms census linked above; the first-run point is that signing in is itself a consent event that happens outside the terminal. A reported opencode issue makes the same point from the other side: a user found that setting the documented sharing and OpenTelemetry off-switches did not fully stop the CLI connecting to remote hosts as of the issue’s filing in December 2025 — its resolution status as of this census date is not confirmed.

No dimension in this census shows the category’s lack of shared convention more cleanly than what Enter does while an agent is already working. Claude Code’s documentation is explicit: “Type a message and press Enter while Claude is working. Claude Code queues the message instead of interrupting the turn.” Esc is the documented interrupt. That behaviour predates the current docs — a March 2026 issue shows the docs of that era claiming Enter interrupts while the actual behaviour, already at v2.1.79, was to queue.

Codex CLI is reported to default the other way. Since Steer Mode — mid-turn message steering — is reported to have shipped default-on around rust-v0.98.0 (2026-02-05), Enter sends the message immediately and interrupts the current turn, while Tab queues it for after the turn completes. That version-and-date pairing is single-sourced from a secondary aggregation (the primary article returned an error on direct fetch), so treat the exact version as reported rather than confirmed; the behaviour split itself is the durable point. Muscle memory built in one CLI silently misfires in the other: the keystroke that safely queues a follow-up thought in Claude Code kills the in-flight turn in Codex.

Read down the third column and the systemic point emerges: the same physical key confirms trust, grants telemetry consent, queues politely, and kills a turn — depending entirely on which tool you happen to be inside. No vendor’s docs would ever assemble this table, because it is inherently comparative and mildly uncomfortable for each of them individually. If you switch between these CLIs daily, a head-to-head of these same terminal tools covers their working styles beyond the first run.

Every CLI in this census that documents its storage writes state to the home directory on or before first meaningful use — none of it behind an opt-in. Several of the paths below were verified by an independent six-CLI session-storage comparison published August 6, 2026. The documented footprints:

• Claude Code creates a hidden ~/.claude directory holding cross-session slash-command history and per-project session transcripts under a flattened-path folder, plus a sessions index. Relocatable via CLAUDE_CONFIG_DIR.
• Codex CLI writes per-session rollout files under ~/.codex/sessions/ by date, plus history.jsonl — automatically, with no separate opt-in. Relocatable via CODEX_HOME. One public issue reported the session files being created world-readable on Unix; its status as of this census date is not confirmed from the record available.
• Cursor CLI stores session data in a database at ~/.cursor/chats/; recent versions added archive and delete subcommands for managing it.
• opencode (adjacent to the nine, checked for storage) keeps sessions in a SQLite database at ~/.local/share/opencode/opencode.db, having migrated from flat JSON as of v1.2.0 in February 2026.
• ZCode persists ~/.zcode/v2/telemetry-state.json — the vendor’s FAQ warns it “contains a device identifier that must not be shared between machines,” which confirms telemetry state is created outside the project even though the collection default itself is undocumented.

The operational consequence: your prompts and the agent’s outputs live in plaintext transcripts outside the repository, surviving repo deletion and travelling with home-directory backups. Anyone standardising agent tooling across a team should treat these paths as part of the data surface — and note that the relocation variables exist precisely because the defaults put session content somewhere most people never audit.

The census reduces to a short discipline you can apply to any CLI — including the ones this table does not cover and the versions that ship after it.

Two related references round out the configuration surface once you are past the first run: how each CLI’s effort and reasoning controls differ covers the dial you reach for next, and the sibling censuses linked in the method section cover what happens when nobody is watching the prompt at all. For teams adopting agent tooling with governance requirements attached, our AI transformation engagements start with exactly this kind of defaults audit across the fleet a team actually runs.