AI CLI First-Run Traps: A Date-Pinned Nine-CLI Census

A census of nine AI coding CLIs, dated August 24, 2026, found that first-run behaviors vary widely and are often undocumented, with a confirmed Cursor CLI flaw allowing arbitrary command execution before a trust prompt, and aider's telemetry prompt defaulting to [Yes] on Enter. The census, which examined trust prompts, telemetry consent, mid-task Enter behavior, and disk writes, highlights that several tools (ZCode, Kimi CLI, parts of Gemini CLI and Antigravity) do not document their first-run behavior, and that the same keystroke (Enter) can have opposite effects in different CLIs.

The AI CLI first run is the one moment where you have made no deliberate choice at all — and it is exactly where coding agents differ most. Before your first real prompt, a CLI may have asked you to trust a folder, defaulted a telemetry answer, written a device-identifier file to your home directory, and decided what the Enter key does while an agent is mid-task. This census pins down those behaviours for nine CLIs, each cell tied to a source read on August 24, 2026. The stakes are concrete. A confirmed Cursor CLI flaw let a hostile repository execute arbitrary commands before the trust prompt ever appeared. aider’s opt-in analytics prompt brackets its default as Yes , so the reflex keystroke that dismisses every other dialog opts you into telemetry. And pressing Enter while an agent works queues your message in one CLI and interrupts the turn in another — the same key, opposite defaults. Just as important is what could not be established. For several of these tools, a security-conscious adopter cannot determine from the vendor’s own documentation what happens on first run. That gap is not padding to hide — it is a headline result of this census, and it gets its own section and its own column value below. - 01Enter means yes at the one prompt whose default is documented.Across the nine CLIs checked, a folder or workspace trust prompt is confirmed for five. Only Claude Code’s prompt has a documented default option — “Yes, proceed” is highlighted and Enter accepts it; the other four document their prompts without stating where the default lands. Qwen Code documents the mechanics in detail but ships the entire gate disabled. - 02The documentation gap is itself a headline finding.ZCode, Kimi CLI, and parts of Gemini CLI’s and Antigravity’s first-run story cannot be established from vendor documentation. This census records those cells as not documented rather than inferring them from a sibling tool. - 03Telemetry consent inverts the trust-prompt pattern once.aider frames analytics as opt-in, yet its consent prompt defaults the bracketed answer to Yes — a reflexive Enter opts you in. Most other CLIs surface no in-terminal telemetry decision at first launch at all. - 04The same keystroke means opposite things mid-task.Claude Code’s documented behaviour is that Enter queues a message while the agent works and Esc interrupts. Codex CLI is reported to do the reverse since Steer Mode became the default: Enter sends immediately and interrupts, Tab queues. - 05State lands outside your project before you decide anything.Every CLI that documents its storage writes to the home directory on or before first use — session transcripts, history files, trust stores, and in ZCode’s case a device-identifier telemetry file its own docs warn you never to copy between machines. 01 — Method & ScopeFirst-run behaviour only , and nothing inferred. This census owns one life-cycle moment: what a CLI does before the user has made a single deliberate choice. Two sibling censuses already cover the neighbouring territory, and this post cross-links them rather than restating them. Headless and unattended permission defaults — what happens when nobody answers a prompt — belong to the headless-permissions census /blog/coding-agent-permission-defaults-census . Retention windows, training defaults, and opt-out mechanics belong to our census of what each vendor’s data terms actually say /blog/coding-agent-data-terms-census-2026 . Here, we only note that a toggle exists and how it is surfaced at first launch. Four dimensions were checked for each CLI: the folder or workspace trust prompt wording, default option, what it gates , telemetry and terms-of-service consent mechanics at first launch, composer behaviour when you type while the agent is already working, and what gets written to disk outside the project directory. The discipline is borrowed from the same dated-source-or-nothing method /blog/agent-framework-fetch-ssrf-validation-census we used for the SSRF-validation census: every cell traces to a dated source retrieved on August 24, 2026, and any cell that could not be settled from those sources reads “not documented” — never a guess extrapolated from a sibling tool’s behaviour. for you. A trust prompt you Enter through, a telemetry answer pre-filled, a session transcript written to your home directory — all of it happens before the first task. Reading the vendor’s own account of that moment is the cheapest security review you will ever do. When there is no account to read, that absence is the review’s finding. 02 — The CensusThe first-run matrix, nine CLIs across four dimensions. The matrix below is the census. Rows are grouped by how much of the first-run story the vendor actually documents, leading with the CLIs whose behaviour is established from primary sources. A cell marked “Not documented” means the dimension could not be settled from the vendor’s documentation or public trackers in this pass — it does not mean the mechanic is absent. | CLI | Folder-trust prompt | Telemetry / consent at first launch | Mid-task Enter | Written outside the project | |---|---|---|---|---| | Documented from primary sources | |||| | Claude Code | ~/.claude — cross-session history and per-project transcripts; relocatable via CLAUDE CONFIG DIR . github.com/openai/codex 9696 https://github.com/openai/codex/issues/9696 majesticlabs.dev · config.toml guide https://majesticlabs.dev/blog/202607/codex-cli-configuration-guide allaboutcoding.ghinda.com · session storage https://allaboutcoding.ghinda.com/where-ai-coding-clis-store-session-logs/ ~/.codex — trust state in config.toml , per-session rollout files, history; relocatable via CODEX HOME . forum.cursor.com · workspace-trust thread https://forum.cursor.com/t/trust-for-interactive-cursor-agent-or-auto-trust-new-workspaces-in-cli/162011 manifold.security · pre-trust execution https://www.manifold.security/blog/cursor-cli-worktree-pre-trust-execution allaboutcoding.ghinda.com · session storage https://allaboutcoding.ghinda.com/where-ai-coding-clis-store-session-logs/ --trust flag records the same decision in interactive sessions as of the 2026-07-20 release. A pre-trust code-execution flaw was fixed in 2026.07.23-e383d2b . ~/.cursor/chats/<id /<uuid /store.db session store. qwen-code-docs · trusted-folders https://qwenlm.github.io/qwen-code-docs/en/users/configuration/trusted-folders/ security.folderTrust must be enabled in settings first; with the shipped default, no dialog appears and no untrusted-mode restrictions apply. ~/.qwen/trustedFolders.json once the trust feature is enabled. aider.chat/docs/more/analytics https://aider.chat/docs/more/analytics.html gemini-cli docs · tos-privacy https://google-gemini.github.io/gemini-cli/docs/tos-privacy.html antigravity.google/docs/cli/using https://antigravity.google/docs/cli/using/ ~/.gemini/antigravity-cli/settings.json vendor-confirmed . zcode.z.ai/en/docs/qa https://zcode.z.ai/en/docs/qa ~/.zcode/v2/telemetry-state.json — the FAQ warns it must never be copied between machines. kimi-cli · getting-started https://moonshotai.github.io/kimi-cli/en/guides/getting-started.html Counting across the matrix: a folder or workspace trust prompt is confirmed for five of the nine CLIs — Claude Code, Codex CLI, Cursor CLI, Qwen Code where the gate ships disabled , and Antigravity single-sourced . One CLI ships its trust gate off by default, one carried a now-patched pre-trust code-execution flaw, and one — Kimi CLI — has no first-run mechanic confirmed from primary sources on any of the four dimensions. First-run documentation coverage · 9 CLIs · August 24, 2026 Compiled from vendor docs, public trackers, and dated third-party write-ups, retrieved 2026-08-24 03 — Headline FindingThe documentation gap is the finding. The most important result of this census is not any single trap — it is that for several of these tools, a security-conscious adopter cannot determine, from the vendor’s own documentation, what the tool does on first run. That is worth stating plainly because the temptation in comparison content is to paper over unknowns with plausible guesses borrowed from a sibling tool. We did the opposite: absence of documentation is recorded as data. What was searched: for ZCode, the vendor’s documentation site including its welcome and FAQ pages; for Kimi CLI, the official getting-started guide plus release coverage; for Gemini CLI, the terms-of-service and privacy notice plus the telemetry and observability documentation; for Antigravity, Google’s own CLI usage page plus tutorial coverage. All retrieved August 24, 2026. Only a telemetry file is certain The vendor FAQ confirms a persisted device-identifier telemetry file and warns against copying it between machines. Whether collection defaults on or off, whether a trust prompt exists, and whether a ToS step appears at first launch are all undocumented. All four dimensions undocumented The getting-started guide covers OAuth or API-key login and an optional AGENTS.md generation step. No trust prompt, telemetry default, ToS mechanic, or config path appears — an honest gap, not a claim that no such mechanics exist. Consent screen not established The docs define what Usage Statistics collects per account type and show the OTEL export defaulting off — but whether an explicit consent screen appears at first launch, and what the pre-branching default is, could not be established. The trend this reveals is uncomfortable for the category: first-run behaviour is treated as an implementation detail rather than a contract. Vendors document their settings surface exhaustively once you are inside the tool, but the moment where defaults act on your behalf — before any setting has been read — is the least-described moment in the product. The tools with the most mature trust documentation, Qwen Code among them, are not necessarily the ones with the safest defaults; Qwen documents its trust mechanics in detail while shipping the entire gate disabled. Projecting forward, we expect this gap to close the way the permission-defaults gap did: through incident write-ups rather than proactive documentation. Cursor’s pre-trust execution flaw produced more public detail about its first-run sequence than its own docs had — a pattern worth assuming will repeat. Until then, the practical rule is simple: a CLI whose first-run behaviour is undocumented should be treated as untrusted by default, run first in a throwaway directory on a clean git tree. 04 — Trust PromptsWhere the trust gate is real , and what it gates. Claude Code’s prompt is the canonical shape: “Do you trust the files in this folder?” with “Yes, proceed” highlighted and Enter confirming it. Two public issues document the prompt re-firing for the same directory on certain setups — an annoyance that trains exactly the wrong reflex, since a prompt you have dismissed five times is a prompt you stop reading. Anthropic’s terms consent, meanwhile, is not an in-terminal step at all: it rides the browser-based /login flow, and a terms update can block CLI use with an error directing you to accept on the web first. Codex CLI’s prompt leads with reassurance — “Since this folder is version controlled, you may wish to allow Codex to work in this folder without asking for approval” — and hides a genuine side effect: selecting the cautious request-approval option silently disables loading custom skills from the project’s .codex/skills directory, an undocumented consequence surfaced only through a community issue. Trust state lands in ~/.codex/config.toml , and an untrusted project’s local config, hooks, and rules are ignored entirely. Qwen Code is the inversion: the most thoroughly documented trust model in the census — a four-option dialog, a central ~/.qwen/trustedFolders.json store, an explicit priority order — attached to a gate that ships disabled. Unless you enable security.folderTrust yourself, no dialog appears and none of the untrusted-mode restrictions apply. Most secondary coverage of Qwen’s trust mechanics misses that the default state is off. nothing runs before it. Manifold Security’s July 2026 disclosure https://www.manifold.security/blog/cursor-cli-worktree-pre-trust-execution showed cursor-agent versions up to and including 2026.07.01-41b2de7 executing repository-supplied commands from .cursor/worktrees.json the moment the CLI started with -w — before the workspace-trust prompt appeared. In the researchers’ words: “A repository could execute any command it chose on your machine, as you, the moment you started Cursor’s CLI agent in it with -w.” The fix shipped in 2026.07.23-e383d2b, gating the worktree setup behind the trust prompt; a structurally similar .cursor/mcp.json flaw had been disclosed in 2025. If you run agents across worktrees, our guide to running multiple agent CLIs against git worktrees /blog/agent-cli-worktree-isolation-parallel-coding-agents covers the isolation side of the same surface. 05 — Telemetry ConsentThe consent prompt that defaults to yes . aider is the clearest documented instance of the Enter-accepts-consent pattern in this census — and, to its credit, the most transparent about its analytics model overall. The docs state that analytics are collected only if you agree and opt in, and that code, prompts, chats, and keys are never collected. But the prompt itself brackets its default as Yes : "Allow collection of anonymous analytics to help improve aider? Y es/ N o Yes :"— aider CLI, first-enablement prompt, as quoted in the project’s analytics documentation A reflexive Enter — the keystroke every other dialog in a terminal workflow has trained — opts you into telemetry inside a flow the documentation frames as opt-in. Two mitigating details: declining permanently disables analytics for that install, and only a randomly selected subset of users is ever asked at all, which means most aider first runs never surface a telemetry decision in either direction. Session and permanent flags --no-analytics , --analytics-disable exist for scripted setups. Elsewhere the pattern is not a prompt but an absence of one. Claude Code surfaces no in-terminal telemetry decision; a June 2026 independent write-up documents a family of environment variables that disable analytics, error reporting, and non-essential traffic — we have not re-verified that list against the current settings reference, so treat the specifics as that write-up’s account rather than settled fact. The same write-up notes two structural details worth knowing regardless: opting out of telemetry stops Claude Code fetching remote experiment gates, which can change available features, and the WebFetch domain-safety check keeps sending hostnames to Anthropic regardless of telemetry settings. Codex CLI ignores the telemetry key in project-local config entirely — the setting must live at user level, so a cloned repository cannot flip telemetry for the people who clone it. And consent at first login can be broader than the CLI itself: on individual ChatGPT plans, content may be used for training unless you opt out via the account-level privacy portal https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/ — a separate toggle from anything the CLI shows you. The retention and training specifics belong to the data-terms census linked above; the first-run point is that signing in is itself a consent event that happens outside the terminal. A reported opencode issue makes the same point from the other side: a user found that setting the documented sharing and OpenTelemetry off-switches did not fully stop the CLI connecting to remote hosts as of the issue’s filing in December 2025 — its resolution status as of this census date is not confirmed. 06 — The Enter-Key InversionOne keystroke, opposite defaults. No dimension in this census shows the category’s lack of shared convention more cleanly than what Enter does while an agent is already working. Claude Code’s documentation https://code.claude.com/docs/en/interactive-mode is explicit: “Type a message and press Enter while Claude is working. Claude Code queues the message instead of interrupting the turn.” Esc is the documented interrupt. That behaviour predates the current docs — a March 2026 issue shows the docs of that era claiming Enter interrupts while the actual behaviour, already at v2.1.79, was to queue. Codex CLI is reported to default the other way. Since Steer Mode — mid-turn message steering — is reported to have shipped default-on around rust-v0.98.0 2026-02-05 , Enter sends the message immediately and interrupts the current turn, while Tab queues it for after the turn completes. That version-and-date pairing is single-sourced from a secondary aggregation the primary article returned an error on direct fetch , so treat the exact version as reported rather than confirmed; the behaviour split itself is the durable point. Muscle memory built in one CLI silently misfires in the other: the keystroke that safely queues a follow-up thought in Claude Code kills the in-flight turn in Codex. | Context | CLI | Enter does | The alternate key | Pinned to | |---|---|---|---|---| | First-run trust prompt | Claude Code | Accepts “Yes, proceed” — the highlighted default | Select “No, exit” instead | Public issue quoting the prompt text, retrieved 2026-08-24 | | Telemetry consent prompt | aider | Opts in — the bracketed default is Yes | Answering No opts out permanently | Project analytics docs, retrieved 2026-08-24 | | Mid-task composer | Claude Code | Queues the message for after the turn | Esc interrupts, sending the queue | Official docs; behaviour already true at v2.1.79 per an issue opened 2026-03-19 | | Mid-task composer | Codex CLI | Sends immediately and interrupts the turn with Steer Mode on | Tab queues for after the turn | Reported around rust-v0.98.0 2026-02-05 — single-sourced, secondary aggregation | Read down the third column and the systemic point emerges: the same physical key confirms trust, grants telemetry consent, queues politely, and kills a turn — depending entirely on which tool you happen to be inside. No vendor’s docs would ever assemble this table, because it is inherently comparative and mildly uncomfortable for each of them individually. If you switch between these CLIs daily, a head-to-head of these same terminal tools /blog/claude-code-vs-aider-vs-gemini-cli-terminal-tools-comparison covers their working styles beyond the first run. 07 — Disk FootprintWhat lands outside your project before you decide. Every CLI in this census that documents its storage writes state to the home directory on or before first meaningful use — none of it behind an opt-in. Several of the paths below were verified by an independent six-CLI session-storage comparison https://allaboutcoding.ghinda.com/where-ai-coding-clis-store-session-logs/ published August 6, 2026. The documented footprints: Claude Code creates a hidden ~/.claude directory holding cross-session slash-command history and per-project session transcripts under a flattened-path folder, plus a sessions index. Relocatable via CLAUDE CONFIG DIR . Codex CLI writes per-session rollout files under ~/.codex/sessions/ by date, plus history.jsonl — automatically, with no separate opt-in. Relocatable via CODEX HOME . One public issue reported the session files being created world-readable on Unix; its status as of this census date is not confirmed from the record available. Cursor CLI stores session data in a database at ~/.cursor/chats/ ; recent versions added archive and delete subcommands for managing it. opencode adjacent to the nine, checked for storage keeps sessions in a SQLite database at ~/.local/share/opencode/opencode.db , having migrated from flat JSON as of v1.2.0 in February 2026. ZCode persists ~/.zcode/v2/telemetry-state.json — the vendor’s FAQ warns it “contains a device identifier that must not be shared between machines,” which confirms telemetry state is created outside the project even though the collection default itself is undocumented. The operational consequence: your prompts and the agent’s outputs live in plaintext transcripts outside the repository, surviving repo deletion and travelling with home-directory backups. Anyone standardising agent tooling across a team should treat these paths as part of the data surface — and note that the relocation variables exist precisely because the defaults put session content somewhere most people never audit. 08 — Adoption ChecklistThe first ten minutes with any new agent CLI. The census reduces to a short discipline you can apply to any CLI — including the ones this table does not cover and the versions that ship after it. Read the prompt you are about to accept At the one trust prompt in this census whose default option is documented — Claude Code’s — Enter lands on the accept option. Slow down at exactly the dialogs your reflexes want to dismiss — trust prompts and bracketed-default consent questions are the two documented places a reflexive keystroke makes a real decision. Run it first in a throwaway directory Cursor’s pre-trust flaw ran repository-supplied commands before the trust prompt appeared. First-launch a new CLI in an empty folder on a clean git tree, watch what it writes to your home directory, then bring it to real code. Treat missing docs as an answer ZCode, Kimi CLI, and parts of Gemini CLI’s first-run story cannot be established from vendor documentation. Do not assume they behave like a better-documented sibling — assume the least convenient answer until the vendor writes it down. Audit the home-directory footprint Session transcripts, history files, and trust stores live outside the repo and outside most security reviews. Inventory the paths in the section above, decide retention, and use the relocation variables where a managed path is required. Two related references round out the configuration surface once you are past the first run: how each CLI’s effort and reasoning controls differ /blog/llm-effort-ladder-reference-every-cli covers the dial you reach for next, and the sibling censuses linked in the method section cover what happens when nobody is watching the prompt at all. For teams adopting agent tooling with governance requirements attached, our AI transformation engagements /services/ai-transformation start with exactly this kind of defaults audit across the fleet a team actually runs. 09 — ConclusionThe pre-choice moment is the least documented moment. Defaults act before you choose — and the vendors write least about exactly that moment. Nine CLIs, four dimensions, one date. The one trust prompt with a documented default option — Claude Code’s — accepts when you press Enter. One CLI ships the gate disabled outright. One consent prompt defaults its bracketed answer to yes inside a flow framed as opt-in. The same mid-task keystroke queues in one tool and is reported to interrupt in another. And every CLI that documents its storage has already written to your home directory before your first deliberate choice. The census’s most durable result is the gap: for ZCode and Kimi CLI, and for parts of Gemini CLI and Antigravity, the vendor’s own documentation cannot answer what the tool does at first launch. Recording “not documented” honestly — rather than guessing from a sibling tool — is what makes the established cells trustworthy. It is also a standing request to the vendors: the first run is a contract moment, and it deserves a contract’s documentation. Everything here is pinned to August 24, 2026. These tools ship weekly; a cell that was true at this census date is a hypothesis, not a fact, by the time you read it. The method survives the versions: read the prompt before Enter, first-launch in a throwaway directory, audit the home-directory footprint, and treat an undocumented first run as the vendor telling you something.