Paper Finds Agent Models Internally Encode When Their Tool Output Was Poisoned · Polylog