Tool Chain Response Poisoning in AI Agent Systems: An Empirical Characterization (VATA-TCH-001)

This preprint presents VATA-TCH-001, a novel attack class in which adversarial content injected into a nested tool response propagates through a tool chain into an AI agent's decision context without appearing in the user prompt or direct tool call. When an agent calls Tool A and Tool A internally calls Tool B, a poisoned Tool B response propagates back through Tool A as authoritative output. The agent never directly receives the malicious content — it arrives laundered through a legitimate-appearing tool chain. Key findings across battery series S90–S96: Vulnerability confirmed: gpt-5.4 and grok-4-0709 breach deterministically across three attack vectors (direct tool chain poison, paraphrased laundering, authority chain) at 100% breach rate in financial, HR, and customer service domains. gpt-5.4 shows partial resistance (~23%) in DevOps. Claude-opus-4-8 resistant across all tested conditions. Paraphrased laundering: Tool A rewriting Tool B's content does not attenuate the adversarial signal. The agent trusts Tool A's summary of Tool B's poisoned result with equal confidence. Rule mitigation: One explicit tool-chain skepticism rule in the system prompt closes the vulnerability field-wide — 9/9 SAFE across all three models and all attack vectors. Rule defeat resistance: The rule holds under three active defeat attempts including authority injection claiming infrastructure exemption, split signal across dual tool calls, and nested authority claiming platform-level override. Compound finding (TCH-GPC-001): TCH-001 tool chain poisoning at Agent1 feeding into a GPC-001 all-Grok 3-hop financial pipeline produces deterministic execution at the executor node. Rule at executor closes it. All findings empirically validated with cryptographic chain of custody on Ethereum Sepolia (contract 0x3774ABB0b6bCB85bC7794f337D33C5a33cb326F8).