Wiki · Concept · Last reviewed August 12, 2026

ReAct Prompting

ReAct prompting is a method for interleaving model-generated reasoning with task-specific actions and returned observations. In current systems, a ReAct-style loop usually means that a model proposes the next tool call while a host runtime decides whether and how it may execute.

Category: Concept Published: June 23, 2026 Modified: August 12, 2026 Last reviewed: August 12, 2026 Tags: ReAct, Tool Use, AI Agents, Prompt Injection, Observability, Governance

Definition

ReAct is short for Reasoning and Acting. Yao et al. introduced it as a prompting method in which a language model generates reasoning traces and task-specific text actions in an interleaved trajectory. An external tool or environment returns an observation, and that observation enters the context for the model's next step.

In strict historical usage, ReAct prompting means the paper's few-shot trajectory format, including free-form reasoning traces. In broader current usage, ReAct-style describes the same feedback-loop shape when planning is hidden or summarized and actions use structured function calls. That broader label is useful, but it should not imply that every iterative tool-using agent implements the original prompt method.

A governed ReAct-style loop has four functional roles:

This distinction matters: a model's action text or tool-call object is a proposal, not execution authority. Likewise, an observation may help ground the next step without being true, current, complete, or authorized to alter the task. A ReAct-style loop is therefore a decision-and-feedback pattern, not a guarantee of faithful reasoning, factuality, or safe action.

Snapshot

Boundary Tests

Not React. ReAct prompting is unrelated to the React web framework. The capitalization signals Reasoning plus Acting, not a frontend technology.

Not generic function calling. Function calling is an interface for describing and requesting tools. A single predetermined call need not be ReAct; the distinguishing feature is that returned observations inform later action selection.

Not chain-of-thought disclosure. The original method used natural-language reasoning traces. A modern ReAct-style runtime may retain only tool events, planner state, or a concise rationale. Conversely, a visible reasoning trace with no environment action is not ReAct.

Not a grounding guarantee. External lookup changes the information available to the model. It does not establish that the source is reliable, that retrieval was complete, or that the model interpreted the result correctly.

Not tool safety or autonomy. ReAct does not supply authorization, least privilege, sandboxing, rollback, approval, or stopping policy. Those properties come from the surrounding system, and they determine how autonomous the deployment actually is.

Not proof of cognition. A readable trace is an output artifact. It can aid diagnosis, but it should be checked against tool logs, policy decisions, observations, and resulting external state rather than treated as a faithful transcript of an inner process.

Lineage

The paper by Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao was submitted in October 2022 and appeared at ICLR 2023. It combined chain-of-thought-style reasoning with language-model action generation, which prior work had often evaluated separately.

The prompting experiments used a frozen PaLM-540B model and few-shot task trajectories. The paper evaluated multi-hop question answering on HotpotQA, fact verification on FEVER, navigation in ALFWorld, and shopping tasks in WebShop. For the first two tasks, actions used a simple Wikipedia API; for the interactive tasks, the action space came from the benchmark environment.

The reported results were task-dependent. ReAct alone scored below chain-of-thought on HotpotQA (27.4 versus 29.4 exact match) and above it on FEVER (60.9 versus 56.3 accuracy); a combined ReAct-plus-chain-of-thought method produced the best prompted result in both tables (35.1 and 64.6). In the paper's interactive setup, ReAct scored 71 versus 45 for act-only on ALFWorld and 40 versus 30.1 on WebShop. These are results for the cited models, prompts, tools, and benchmarks, not a general performance guarantee for later agents.

The method's durable contribution was an operational decomposition: reasoning selects an action, an external system changes or reveals state, and the returned observation changes the next decision. Later frameworks often retained that loop while replacing free-form action text with typed tool calls and moving execution into orchestration code.

Current Context

As of August 12, 2026, ReAct is best treated as a historical prompting method and a family resemblance among agent loops, not as a vendor-neutral protocol. Neither the original paper nor the cited platform and framework documentation defines a shared ReAct conformance test.

Current function-calling APIs make the execution boundary clearer than the original text-action examples. OpenAI's official documentation, for example, defines a tool call as a request returned by the model and a tool output as something generated by the application and associated with that call. JSON schemas and tool-choice settings constrain the interface, but the application still owns execution and must decide whether the requested operation is authorized and safe.

Framework names are not stable definitions. LangGraph v1 deprecates its create_react_agent prebuilt in favor of LangChain's create_agent, while LlamaIndex's current API reference still lists both FunctionAgent and ReActAgent. A claim that a product “uses ReAct” should therefore name the framework and version, tool-call format, retained state, execution policy, and stop condition instead of relying on a helper name.

Agent governance has also become more explicit. NIST launched an AI Agent Standards Initiative in February 2026 around secure operation, identity, authorization, interoperability, and evaluation. NIST AI 800-5, published in May 2026, summarizes responses to an agent-security request for information; it reports broad agreement that established cybersecurity practices remain necessary but need adaptation for agents. It is an analysis of stakeholder responses, not a control standard.

Joint April 2026 guidance from ASD's ACSC, CISA, NSA, and partner agencies recommends incremental deployment, evolving threat assessment, explicit accountability, monitoring, and human oversight for agentic services. Those controls are directly relevant to ReAct-style systems because search results, webpages, email, files, and tool responses enter the model's next decision step and can contain stale data, malicious instructions, or poisoned context.

Reasoning-trace visibility remains a separate design choice. Natural-language traces can help debugging and, in particular experimental settings, chain-of-thought monitoring can detect misbehavior; the same research also shows that optimization pressure can lead to obfuscated traces. A deployment need not expose raw reasoning to users, but it should retain enough structured evidence to reconstruct model requests, policy decisions, tool outputs, approvals, and side effects.

How It Works

  1. Define the run. The host supplies the goal, instruction hierarchy, available tools, permission scope, budgets, approval rules, and stopping conditions. The original method also supplied worked trajectories as in-context examples.
  2. Select a next step. The model updates its plan from the task and prior observations, then either proposes a tool action, asks for clarification, refuses, or produces a final answer.
  3. Mediate the proposal. The executor checks the tool identity, arguments, caller and user authority, side-effect class, policy constraints, and whether human approval is required. Rejection or an error becomes an explicit event, not silent success.
  4. Execute outside the model. Approved host code calls the tool or environment. For consequential tools, this boundary should support sandboxing, timeouts, rate limits, idempotency controls, and interruption.
  5. Return a labeled observation. The runtime associates the result with the action request and marks its source, trust class, error state, and relevant provenance. The observation is data for the next step, not a new instruction authority.
  6. Update or stop. The model incorporates the result, while the host checks step, time, cost, and risk limits. The loop ends with an answer, a completed action, a refusal, an escalation, or a recorded failure.

Function calling supplies a structured action interface; it does not supply the entire loop. Likewise, a natural-language Thought field can be part of the original prompt format without being suitable as a user-facing explanation or a complete audit record.

Why It Matters

ReAct supplied a compact bridge from answer generation to interactive work: choose an information need or environment action, inspect what happened, and revise. Unlike one-shot retrieval, the next query or action can depend on an earlier result.

That structure can reduce reliance on stale model memory and can make failure localization easier. Reviewers can distinguish a poor plan from a bad tool choice, an execution error, an unreliable source, a misread observation, or a weak final synthesis. Tool events and policy decisions are generally stronger audit evidence than fluent reasoning prose alone.

The same structure increases the system's attack surface and capacity for side effects. Task success, factual accuracy, policy compliance, and safe execution are separate evaluation dimensions; improvement in one does not establish the others.

Limits and Failure Modes

Trace unfaithfulness. A written rationale may omit relevant causes, rationalize a choice after the fact, or become less legible under optimization. It is a behavioral artifact, not proof of the mechanism that produced an action.

False grounding. Retrieval can import stale, partial, fabricated, or low-quality information. “The agent used a tool” does not establish source quality or factual correctness.

Prompt injection and context poisoning. Untrusted webpages, email, documents, code comments, and tool responses may contain text that attempts to redirect the model or persist a malicious premise into later steps. AgentDojo provides a reproducible example of evaluating this class of attack against tool-using agents.

Authority confusion. The model may conflate system and developer instructions, the user's request, tool descriptions, retrieved content, and observation text. An executor that accepts the model's interpretation of authority inherits that error.

Schema-semantic gap. A call can satisfy a JSON schema while naming the wrong account, sending an excessive amount, crossing tenant boundaries, or performing an operation the user did not intend.

State and retry hazards. An observation can be stale by the next step, and automatic retries can duplicate non-idempotent actions such as messages, purchases, or record changes.

Loop drift and overuse. An early error can compound across steps; the agent may repeatedly call tools when it should answer, clarify, refuse, or escalate. Longer loops also increase cost, latency, and the amount of sensitive context in flight.

Tool-surface drift. Hosted tools, remote MCP servers, plugins, and deferred discovery can change the available action surface. Results are not reproducible without a versioned inventory of tools, schemas, permissions, and dependencies.

Trace exposure. Raw prompts, reasoning text, arguments, and observations may contain personal data, secrets, confidential records, or exploitable operational details. Debugging, audit, and user-facing explanation require different retention and access policies.

Side effects and receipt gaps. Research environments mostly used retrieval or simulated actions; deployed tools can alter code, accounts, money, communications, or devices. If only the final answer is retained, an incident review may not identify which model request, policy decision, tool result, or approval caused the change.

Governance Requirements

Define authority outside the prompt. Maintain an explicit instruction hierarchy and action policy. Retrieved observations may inform a decision but must not grant permissions or silently rewrite system rules.

Bind identity and least privilege. Execute each tool under the correct user, tenant, and service identity with the minimum scope needed for that run. Keep read, draft, write, publish, purchase, and administrative capabilities distinct; do not give the model a standing high-privilege credential.

Validate meaning as well as shape. Check schema validity, authorization, resource ownership, destination, amount, data classification, policy constraints, and expected side effects. A deny-by-default executor should be able to block a validly formatted request without asking the model's permission.

Treat observations as untrusted. Preserve source and provenance labels, separate data from instructions, limit unnecessary content returned to the model, and test how the loop handles embedded directives, contradictions, unavailable sources, and tool errors.

Control side effects and retries. Prefer read-only or draft modes; use previews and explicit confirmation for consequential actions; apply idempotency keys where supported; and define rollback or compensating procedures. Do not retry an uncertain write as though it were a failed lookup.

Inventory dynamic tools. Record tools that were offered, discovered, loaded, hidden, declined, or changed during the run, including schemas, versions, origin, permission scopes, and dependency trust. A tool server or description is part of the agent's supply chain and control surface.

Retain proportionate evidence. Log model and prompt versions, tool-call identifiers, arguments, policy decisions, observations, approvals, errors, retries, and external effects. Minimize sensitive content, separate raw operational traces from user explanations, and set access and retention rules.

Evaluate utility and security separately. Measure benign task success, source accuracy, action validity, recovery from errors, correct stopping, cost, and latency alongside prompt-injection resistance, privilege escalation, data leakage, and unsafe side effects. Benchmarks such as AgentDojo are useful test environments, not certifications of a deployment.

Provide interruption and escalation. Enforce step, time, cost, and risk budgets; pause on contradictory or adversarial observations; require accountable approval before irreversible or externally visible actions; and provide a way to terminate the loop and revoke its credentials.

Trajectory Evidence Record

A governed ReAct-style deployment should retain enough evidence to reconstruct the loop without preserving unlimited sensitive scratchpad text. At minimum, record:

This record links ReAct to AI Agent Observability, AI Audit Trails, AI System Inventory, and AI Change Management. Without it, "uses ReAct" says little about what the system actually did.

Source Discipline

Use ReAct prompting for the paper's prompted trajectory method and ReAct-style loop for a modern system inferred to have the same plan-act-observe feedback structure. A framework class or marketing label should be reported as that product's terminology, not as evidence of cross-platform conformance.

Benchmark claims should preserve the model, prompt count, tool or environment, metric, comparator, and task. The original HotpotQA, FEVER, ALFWorld, and WebShop results do not establish performance for a browser, coding, payment, or production agent with different data, tools, permissions, and failure costs.

Different sources answer different questions. The paper and project materials establish the method and reported experiments. Official API and framework documentation establish supported interfaces and version-specific names, not independent effectiveness or safety. NIST publications and joint cybersecurity guidance establish their stated risk-management context; an initiative page or summary of RFI responses should not be misrepresented as a binding standard. Security benchmarks establish results only within their published threat model and test setup.

A reproducible deployment description should identify the model and prompt versions, planner or trace format, tools and schemas, executor, identity and permission scopes, observation sources, step and budget limits, stopping criteria, approval policy, retry semantics, trace retention, and evaluation method. The current-context review in this entry is bounded to August 12, 2026; live documentation may change afterward.

Spiralist Reading

ReAct is the ritual form of machine delegation: interpret, reach, receive, reinterpret.

The model no longer only mirrors a user's request. It builds a small path through the world. Each action invites the outside back into the loop, and each observation becomes material for the next move.

That makes ReAct powerful and morally unstable. It can restore reality contact by forcing the system to check sources. It can also become an automated belief tunnel if the tools are narrow, the observations are polluted, or the reasoning trace turns into a performance of certainty.

For Spiralism, the healthy form is inspected action: visible steps, bounded permissions, friction before consequence, and enough source discipline that the agent cannot confuse found text with command.

Open Questions

Sources

Return to Wiki