Bug in habtm?

No, its not a bug, the sql generated by the :first option returns whatever results matches it can be any record. It is the SQL that behaves this way, it is not Rails fault.