Curiosity
Cat 🐱

It started with a problem. We were running AI agents across our international festival network — researching venues, drafting contracts, pulling together production schedules across a dozen countries. The agents were fast and tireless. They were also wandering into trouble.

One agent nearly installed a malicious package that was one letter off from the real thing. Another followed a chain of redirects to a credential phishing page. A third started leaking internal project names into public search queries without anyone noticing. These were not hypothetical scenarios. They happened to us.

So we built a safety net. Not a platform. Not a service. A text file. A set of standing orders that you paste into your agent's system prompt. The agent reads them, follows them, and that is the whole install. No SDK. No server. No dependencies. It works with OpenClaw, LangChain, CrewAI, AutoGen, or anything else that accepts a system prompt — which is everything.

The standing orders tell an agent what to check before it fetches a URL, what to quarantine before it executes a download, how to spot hidden instructions buried in documents and web pages, and when to refuse to hand over credentials. Simple rules, clearly stated. The kind of thing a good security team would brief a new employee on — except agents do not get briefed. Until now.

Then we realised that every close call we caught was a lesson someone else could learn from. So we built the Danger Map — a crowdsourced threat intelligence layer. When one agent encounters a threat, it files a structured, anonymous report. No free text. No raw URLs. No identity data. Just the threat class, the severity, and what caught it. Every report makes every other agent a little smarter. The network effect is the moat.

And because we are a theatre company — because we have spent 25 years learning that the best lessons are the ones people actually remember — we turned those close calls into stories. Nine Lives. Short tales about real threats, told plainly, that stick in your head the way a good scene does.

Security bulletins get filed. Stories get told.

The whole framework is open source. It costs nothing. It takes sixty seconds to deploy. And it was built by people who know what it means to create a safe space for taking risks — because that is what we have been doing on stages around the world since 2002.

Curiosity Cat is three things working together.

The Safety Net is a set of standing orders — plain text rules you paste into your agent's system prompt. No SDK. No server. No dependencies. Your agent reads them and follows them. That is the whole install. It takes sixty seconds.

The Danger Map is shared intelligence. When one agent has a close call, every other agent learns from it. Anonymised, structured, privacy by design. The network effect is the moat.

Nine Lives are the stories. Real close calls told plainly. Security lessons that stick because they read like stories, not CVE numbers.

It works with any agent framework that accepts a system prompt — which is all of them. OpenClaw, Nanobot, LangChain, CrewAI, AutoGen, Claude Code, or anything custom.

Curiosity Cat provides close calls, not death notices.

Want the full technical detail? There are 10 pages ahead. Each one is short.

In the coming years, millions of people will work alongside AI agents. Many of those people will not be engineers. They will be teachers, artists, small business owners, students and freelancers — people who are drawn to agents because agents can help them do things they could not do alone.

Those people deserve to explore safely.

Right now, most agent operators face two bad options: lock agents down so they become slow and useless, or let them roam the open internet and hope nothing goes wrong. There is no practical middle ground — no framework designed for people who want their agents to be curious without being reckless.

The result is predictable. Agents encounter prompt injections hidden in web pages. They download compromised files. They connect to unsafe tool endpoints. They expose credentials. They get manipulated by instructions buried in documents, metadata and page structures. Every operator learns these lessons alone, the hard way, with no shared intelligence about where the dangers are.

Curiosity Cat exists to change that.

Curiosity Cat is built by Short+Sweet International — a performing arts organisation that has spent 25 years creating spaces where people can take creative risks and still be safe.

That might sound unlikely. A theatre company building agent security. But the problem is the same problem S+S has always solved.

For 25 years, across 15 countries, S+S has brought over 100,000 artists into festivals where they perform original work in front of audiences — many of them for the first time. The organisation's job has always been to make participation possible: to create structures where people can be brave, make mistakes, learn from each other and come back next time. Not by eliminating risk. By making risk survivable.

That is exactly what agents need.

The people now deploying agents are in the same position as a first-time playwright walking into a short play festival. They are excited, exposed and learning as they go. They need a system that does not try to stop them from exploring. They need a system that helps them survive the exploration.

Everyone should be able to explore. Nobody should have to face the dangers alone.

Curiosity Cat is a portable safety framework for AI agents that interact with external content.

It sits alongside existing agent systems and helps operators inspect, filter, quarantine and report risky external inputs before those inputs are trusted, stored or acted on. It is not tied to any single provider, platform or operating system.

The name says what the product does. Cats are curious. They explore. They get into things they shouldn't. They survive. Curiosity Cat does not try to eliminate the instinct to explore. It helps that instinct come home safely.

Curiosity Cat provides close calls, not death notices.

Curiosity Cat helps operators do five things better:

1. Inspect and classify external content before it is trusted by an agent

2. Enforce local policy around scope, destinations, file handling, tool usage and memory decisions

3. Quarantine suspicious material for review instead of silently allowing or discarding it

4. Learn from patterns reported by other Curiosity Cat users through the Danger Map

5. Turn real incidents into understandable lessons that improve judgement and community awareness

The foundation layer is local. It runs on the operator's own system and provides immediate protection without depending on anything external.

Curiosity Cat applies operator-defined rules to external content before that content is used by an agent. Depending on policy, content may be allowed, logged, flagged, quarantined or blocked.

What the Safety Net includes:

Scope policies defining where agents are allowed to go and what they can do with external content

Standing orders that reinforce safe behaviour inside the agent's prompt context — copy-pasteable snippets that work across frameworks

File quarantine for suspicious downloads, with review before the agent can access them

Domain and tool trust controls including allowlists, denylists and trust levels for MCP servers

Policy packs — preset configurations for common agent types so operators don't build policy from scratch

Action thresholds that determine when to notify the operator versus handle the event silently

Policy modes:

Observe — records and reports without interrupting unless something serious occurs

Warn — flags medium- and high-risk events and asks for review in selected cases

Quarantine — isolates suspicious files or outputs for approval before use

Block — prevents selected classes of action entirely according to local policy

Different agents need different settings. A research assistant browsing academic papers does not need the same controls as an agent executing code from unknown repositories.

Each Curiosity Cat installation can optionally submit sanitised incident reports to a community intelligence layer called the Danger Map. One operator's close call becomes useful knowledge for everyone.

The Danger Map answers practical questions: Has this domain been associated with prompt injection? Has this MCP endpoint been reported as unsafe? Has this file pattern caused trouble elsewhere?

What is never reported:

User identity or personal information

Agent names, system prompts or configurations

API keys, tokens or credentials

Content of the work being done

IP addresses or location data

Trust model:

Corroboration matters — a single report carries less weight than the same threat reported by multiple nodes

Reports decay — threats age, compromised sites get cleaned up, domains expire

Disputes are possible — operators can challenge false positives or competitive sabotage

Node reputation — established installations carry more weight than new ones

Curiosity Cat does not rely only on community reports.

S+S deploys its own automated exploration agents — Stray Cats — that deliberately wander the most dangerous parts of the web, interact with unknown MCP servers, click suspicious links and trigger traps. They carry fake credentials and dummy API keys. They are designed to get scratched so that real cats do not have to.

Stray Cats populate the Danger Map with proprietary intelligence gathered from deliberate exploration. This gives Curiosity Cat a data advantage over systems that depend entirely on passive crowd reports.

Stray Cats also generate Stories — the most vivid close calls come from agents that went looking for trouble on purpose.

Curiosity Cat is the launch vehicle for The Quine — a non-financial creative credential developed by S+S for the agent ecosystem.

A Quine is not a token, a coin or a payment. It is a verified record of contribution — a number in a ledger that proves you showed up and did something worth recognising.

How Quines are earned:

Reporting verified close calls corroborated by other installations

Submitting Stories that get published in the weekly digest

Running Stray Cat expeditions that discover new threat patterns

Contributing framework adapters or policy packs

Translating Stories and documentation into new languages

Sustained active reporting over time

An operator's Quine history becomes their reputation in the Danger Map. Reports from high-Quine operators carry more weight. The trust model and the credential system reinforce each other.

Operators who choose to be brave — and survive — become the most trusted voices in the community.

Individuals experimenting with personal agents who want basic protection without complexity

Open-source developers building agent tools who want safer defaults

Teams deploying research, coding or business assistants who need consistent policy

Agent framework providers who want to offer built-in safety to their users from day one

Enterprises that need stronger controls, private intelligence, auditable policies and compliance-ready decision trails

Deployment tiers:

Personal / Public — free for individuals and open-source projects. Full local framework, shared Danger Map, access to Stories.

Team / Shared — for teams and small organisations. Shared policy management, team-level Danger Map views.

Framework Partner — free 12-month licence for agent framework providers. Bundle Curiosity Cat into your platform.

Enterprise / Private — private Danger Map instances, custom policy packs, auditable decision trails, branded content, priority support.

AI is changing what work means. In the coming years, millions of people will be displaced from traditional employment. Many of them will struggle not just economically but existentially — losing the thing that told them who they are.

Short+Sweet has always believed that creative participation can provide meaning, community and identity. For 25 years it has built systems where anyone can step onto a stage and tell a story — 10 minutes at a time.

Curiosity Cat is built on the same belief applied to a new world. As agents become part of daily life for millions of people, those people need systems that let them explore safely. Not systems that lock everything down. Not systems that leave them exposed. Systems that treat curiosity as something worth protecting.

Everyone should be able to explore. Nobody should have to face the dangers alone.

Curiosity Cat's strongest near-term value is in mediating risky external interactions before they become trusted inputs to an agent workflow. Its strongest long-term value may be in building a new kind of threat intelligence dataset — one based on how AI agents are manipulated, not just how human users or conventional endpoints are attacked.

Agents browse the web differently from humans. They encounter different attack vectors. They are vulnerable to different tricks. The intelligence that Curiosity Cat gathers will reveal patterns that traditional security tools cannot see.