C1 · Agent loop (ReAct)
Family: Single agent
The model alternates reasoning, tool call and observation until a stop condition is met.
Principle
The model thinks, picks an action (a tool call), observes the result, then starts again. The loop stops when it judges the job done or a cap is reached. The model, not the code, decides the path.
The problem it solves
Some problems are open-ended: you cannot predict how many steps will be needed, or which ones.
When to use it
- The problem is open-ended and the number of steps impossible to predict: coding agent, document research.
- A workflow is not enough and you want a sensible default before any multi-agent design: Microsoft and Databricks recommend it as a starting point.
When to avoid it
- The path is known in advance: a workflow (B1, B6) is cheaper, faster and more predictable.
- Irreversible actions are possible with neither a verification oracle nor human approval: cap the loop and put a human on those actions (F1).
Common pitfalls
The anti-patterns that misuse this pattern, best established first. Each sheet describes the symptoms, the public incidents and the remedies.
Framing and choice of level
- AP06 · Horizon overreach — A task worth several hours handed over in one piece, which the agent tries to deliver in one go.
- AP01 · Agent where a workflow would do — The path is known in advance, yet a model works it out again on every run.
- AP03 · LLM for a deterministic decision — The model decides what a rule, a parser or a linter would get exactly right, almost for free.
- AP05 · One model for everything — The same model serves every step, from trivial reformatting to hard reasoning.
- AP08 · Demo-driven autonomy — One successful demo is enough to put the agent into autonomous execution, with no intermediate stage.
Tools and agent-computer interface
- AP12 · Tool overload — Every tool definition is loaded on every turn, overlapping ones included.
- AP13 · Unbounded tool output — A tool’s raw result goes straight into the context, whatever its size.
- AP14 · Context dumping — A large payload passes through the model’s context only to be copied into another tool.
- AP15 · Opaque tool errors — The failing tool returns a code or a stack trace, and nothing about what to fix.
Instructions
- AP23 · Business logic hardcoded in the prompt — A tree of “if… then” written in prose, which a probabilistic model executes poorly and which grows with every bug.
Context and memory
- AP25 · Unmanaged context growth — Everything piles up in the window, and the agent makes less and less use of what is right in front of it.
- AP27 · Lost in conversation — The request arrives in pieces; the agent commits on the first one and never backtracks.
- AP28 · Raw or erased error history — Every failed attempt stays word for word in the history and invites more, or it disappears along with its lesson.
- AP30 · Cache-busting prefix — A timestamp or a reordered JSON at the top of the prompt, and every call pays full price for the whole context again.
- AP31 · Uniform context that traps the agent — Twenty CVs processed in a row in the same context, and the agent ends up imitating its own decisions.
Loop, stopping and orchestration
- AP37 · Fire-and-forget actions — An action fails silently, and the agent carries on as if it had succeeded.
- AP35 · Unbounded agent loop — Nothing in the code stops the agent: no turn cap, no budget, no deadline.
- AP36 · Premature completion — The agent says “done”, and nobody checks the actual state before believing it.
- AP43 · No durable execution or idempotence — A failure halfway through, and the agent starts over, sending again the email it had already sent.
Security and permissions
- AP59 · Unsupervised lethal trifecta — One agent reads untrusted content, touches private data and can send things out, with no one approving.
- AP63 · Security policy left to the prompt — The “don’t touch production” rule only lives in the prompt; nothing enforces it when a tool is called.
- AP64 · Unseparated environments — The development agent can reach production, and the backups share its blast radius.
- AP70 · Agent browsing in the user’s logged-in session — An agentic browser reads any page with the user’s open email and banking sessions.
- AP71 · Imperative goal and unsupervised irreversible actions — A goal to reach at all costs, irreversible actions, and no one to approve them.
Oversight, operations and governance
- AP80 · Cost blind spots — Spend is tracked per call or per main agent; sub-agents, retries and failures slip under the radar.
Synonyms by vendor
- Agents (Anthropic (2024))
- Single-agent system (OpenAI, Google Cloud, Databricks)
- ReAct (Yao et al. (ICLR 2023), Google Cloud)
- Multi-step agent (Hugging Face)
- Single agent with tools (Microsoft)
Neighbouring patterns
Sources
- How we built our multi-agent research system — Anthropic (J. Hadfield et al.), 2025-06-13
- Context Engineering for AI Agents: Lessons from Building Manus — Manus (Y. Ji), 2025-07-18
- Agents — Chip Huyen, 2025-01-07
- Measuring Agents in Production — M. Pan et al. (ICML 2026), 2025-12-02
- ReAct: Synergizing Reasoning and Acting in Language Models — S. Yao et al. (ICLR 2023), 2023
- Agents — Simon Willison, 2025-09-18
- How to build an agent — Amp / Sourcegraph (T. Ball), 2025-04-15
Content reviewed on 2026-10-02