The story
First use appears c. 1753 or 1770. The inverse of the idiom pig in a poke. If a dishonest merchant tries to sell a cat as a pig and the cat comes out or is taken out of the bag, the merchant's secret is disclosed.
Etymology from Wiktionary, CC BY-SA 4.0.