The answer is: Autovivification.

In the case of [grep { $_->{"aaa"} < 4 } @x]->[0]->{"aaa"}, the grep returns an empty list, which means the expression is the equivalent of []->[0]->{"aaa"}. [] creates a new anonymous array and returns a reference to it, and then the following dereference operations autovivify both the 0th element of the array, as well as the reference to the new anonymous hash in that element. And since the element aaa doesn't exist in that hash, the whole expression returns undef.

In the second case, first is simply returning undef, which can't be dereferenced with ->{"aaa"}, hence the error.

If the reason you're using first here is simply to stop the search on the first found element, then you could use the same "trick" as described above*. [first { $_->{"aaa"} < 4 } @x]->[0]->{"aaa"} will work, with a minor difference: the first arrayref in the chain will not be empty, but it will be [undef], that is, an array with one element, that element being undef. Perl doesn't need to autovivify the 0th element, and still autovivifies the hash reference in place of the undef in that case.

$ perl -MData::Dump -e 'my $x = []; dd !!$x->[0]->{"aaa"}; dd $x;'
""
[{}]
$ perl -MList::Util=first -MData::Dump -e 'my @x; dd [first {$_} @x]'
[undef]
$ perl -le 'print( (undef)->{"aaa"} )'
Can't use an undefined value as a HASH reference at -e line 1.
$ perl -MList::Util=first -MData::Dump -e \
  'my @x; my $y=[first {$_} @x]; dd $y; dd !!$y->[0]->{"aaa"}; dd $y'
[undef]
""
[{}]
[download]

See also perlref.

* Update: Though personally, I would probably tend towards a two-step process: first using first to find the element, and then checking whether that result is undef or not before attempting to access it. Of course this would require two statements instead of one, so it'd be a bit more verbose, but thereby also more clear. And at least I think probably a tiny bit more efficient, since it wouldn't need to autovivify anything just for the test - but whether that would even make a difference depends on how often the code gets called. But TIMTOWTDI and I also understand the desire for more terse code.