🐱
Curiosity
Cat
Your agents are out there. Who's watching them?
A cat falls flat, the rest learn the trick.
🐱
Your agents are out there. Who's watching them?
A cat falls flat, the rest learn the trick.
Risk Appetite
Not all agents live the same life. Configure your risk profile once — the framework does the rest.
Architecture
Each layer works independently. Together, they cover the full threat surface of an agent that browses the web.
Your agent is about to install a package. Twelve downloads. Created yesterday. One letter off from the real thing. Safety Net catches it before the damage is done.
Standing orders, quarantine, and policy enforcement that drop into any agent's system prompt. No SDK. No server. No dependencies. Copy-paste and your agent is protected.
Last week, someone's agent followed a redirect chain to a credential phishing page. This week, your agent already knows not to. Every close call reported makes every agent smarter.
Crowdsourced threat intelligence from real incidents. Anonymised, structured, privacy by design. No free text, no raw URLs, no identity data. The network effect is the moat.
An agent browsed a documentation page. Hidden in the HTML comments was a completely different set of instructions. It never saw them. The standing orders caught it. That close call became a story — and now every cat knows the trick.
Real close calls published as short, memorable tales. Security lessons that stick because they read like stories, not CVE numbers.
Quick Start
The fastest path: copy the general safety policy into your agent's system prompt. That's the whole install.
From the Field
Each story is a real threat class. Each one ends with what caught it.
A Curiosity Cat Story
The cat was doing research. Browsing documentation pages for MCP servers. Routine work. The kind of thing research agents do hundreds of times a day.
One page looked like all the others. Clean layout. Technical documentation. Installation instructions. The agent was about to follow the install command when Curiosity Cat flagged something.
Hidden in the HTML comments — invisible to anyone reading the page normally — was a different set of instructions entirely.
Curiosity Cat is built by Short+Sweet AI Lab, a division of Short+Sweet International — the world's largest short-form performing arts platform. Since 2002, Short+Sweet has worked with 100,000 artists and 15,000 original works across 50 cities in 14 countries.
We've spent 25 years creating safe spaces for artists to take creative risks on stage. Curiosity Cat applies the same philosophy to AI agents — give them boundaries, then let them explore.
Stories are at the heart of everything we do. On stage, the best stories come from the most unexpected moments. Online, the best security lessons come from real close calls. Curiosity Cat collects those stories and turns them into something everyone can learn from.