ACID CAT

Every agent framework breaks in the same place: the interface. APIs rate-limit, extensions get detected, drivers need install rights. ACID CAT goes underneath all of it, a small ESP32-S3 board that plugs into USB and enumerates as an ordinary HID keyboard and mouse. No driver, no extension, nothing to integrate. To the target machine it is a person typing, which is the one integration surface no vendor can withdraw.

The device does more on one cable than it looks like it should. It runs as a composite USB device, HID keyboard, HID mouse and a CDC serial console simultaneously, while also serving a JSON HTTP API on port 8080 over WiFi, running a six-characteristic BLE GATT service, and driving a 240x280 touchscreen with its own menu system. Six ways in: serial, HTTP, BLE, the on-device touch UI, a Web Bluetooth page that provisions WiFi from a browser tab with nothing installed, and a one-line shell wrapper. HID mice only speak relative deltas, so the firmware maintains a virtual cursor and implements absolute moveto as an interpolated stream of int8-clamped reports. The JSON parsing is hand-rolled indexOf scanning rather than a library, no allocator, no heap fragmentation on a device meant to stay up for days.

The half nobody expects is that it can see. A pure input device is blind, so we built the eyes out-of-band: the host takes a screenshot and reconstructs a UI tree from raw pixels, tesseract lines regrouped into elements, then classified into buttons, inputs, links and tabs by Canny edge density and interior variance, modals found by dual-threshold contour geometry so it works on light and dark themes, and the mouse cursor located by template-matching a pointer shape synthesized in code. That last piece closes the loop: the mouse calibrates by slamming into the screen corner, then verifies every move against a fresh screenshot and issues corrective deltas when the OS's pointer acceleration eats the difference. Clicks can demand proof, screenshot before, screenshot after, retry with jitter if the screen didn't change. On top sits a declarative JSON macro runner with wait_for, verify, click-by-label and live TOTP generation; the reference macro logs into a 2FA-protected site end to end with zero software on the target. And there is a bongo cat on the front that drums the correct paw for whichever half of the keyboard your current character lives on, because we built the hardware and could.