United Airlines Shuts Out Unauthorized AI Agents. Here Is What the Policy Actually Covers

United Airlines has told AI shopping agents to stay out. On November 11, 2026, the carrier said it is restricting “unauthorized, third-party personal AI agents or assistants” from its website and app. The restriction also covers indirect access through travel agencies and aggregators, and comes with changes to United’s booking, ticketing and distribution policies. United gave three reasons: customer data security, the risk of purchases and account changes customers did not intend, and aviation rules that it says require a human to complete some steps. The move is broader than a block on a few booking tasks, and it lands as other industries split over whether to fight AI agents or partner with them.

What United announced

The United news release starts with account security. “Sharing account credentials with personal, third-party, AI assistants can expose sensitive information,” the airline said, “and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles.” It also gave a regulatory reason. According to United, automated AI actions “have the potential to violate FAA and DOT regulations,” because flight check-in requires a human to confirm that bags do not contain banned items such as explosives.

United said it would restrict access “directly within our digital platforms and indirectly via travel agencies and aggregators.” It also urged other companies to consider similar measures, pointing out that banks and retailers have already acted. Reuters reported that Amazon has blocked Meta’s AI agent Muse while Walmart has partnered with it, and that online travel companies including Expedia and Booking are working with OpenAI.

How far the restriction reaches

The details are on United’s help page on unauthorized third-party AI agents. Several points are broader than first summaries suggested:

• Definition. A tool is unauthorized if it is “a third-party AI agent, bot, browser extension or browser feature” that “searches, books, buys, manages or collects information” on united.com or the United app without United’s permission. That reaches agentic features built into AI-enabled browsers, not only standalone assistants.
• Customer consent is not enough. “Just because you’ve given access to AI assistants doesn’t mean United will permit an AI assistant to transact with United,” the page says.
• Agencies are covered. Travel agencies and booking platforms “cannot use third-party AI agents” to search, book or manage United travel on direct or indirect channels. Agencies may use their own AI tools only with United’s permission.
• No partners yet. Asked whether it works with any third-party AI agents, United answers “Not yet,” and says it wants “standardized, secure technology integrations with privacy, security, authorization and accountability protections in place.”
• Carve-outs. Research is allowed as long as the tool stays off United’s platforms. Existing agent-made bookings from before November 11, 2026 will not be canceled. Assistive technology for customers with disabilities “isn’t affected.”

The page also tells customers not to give AI tools their MileagePlus number, password, confirmation codes, or details used to confirm identity such as name, birth date or address. Anyone who has already shared MileagePlus login details with an agent should change their password right away, United says.

Why this is a data protection story

The new restriction sits where three problems overlap.

Credential sharing. Most consumer agents today work by logging in as the user. For a loyalty account, that means a third party holds a password that can move miles, change itineraries and see travel history. The same worry is familiar in financial services, where banks are working out what happens when a customer delegates access and later wants to take it back. Wells Fargo’s approach to revoking an AI agent’s authority shows how quickly that becomes a liability question.

Authority and attribution. When an agent buys a non-refundable fare, whose decision was that? United’s list of “unintended purchases, account changes” describes a dispute it would rather avoid. Industry work on agentic commerce standards being drafted by FIDO, Google and Mastercard tries to solve this with verifiable proof of what the user actually authorized. United is effectively saying it will wait for that kind of infrastructure before letting agents in.

Regulated steps that need a person. The check-in example matters. Some steps exist to get a personal attestation. An agent clicking “I agree” for a passenger does not provide one, and United is right to point that out.

Regulators are starting to say similar things. Singapore’s consumer advisory on personal AI agents tells people to limit what an agent can access and to stay in control of important actions. In Europe, the Bavarian regulator’s guidance on AI agents puts agent deployments on its audit list. United’s help page reads as a consumer-facing version of the same advice.

The commercial subtext

Security is the stated reason, but it is not the only factor. Engadget, citing The Wall Street Journal, reported that United CEO Scott Kirby said at an event on Tuesday, “I don’t want to create another middleman.” JetBlue president Marty St. George, speaking at the Skift Commerce Summit, told Reuters he understands why intermediaries “may be intimidating.” He worries that AI intermediaries could eventually charge airlines for directing bookings. He also said airlines should be “responsive to what customers want.” Not every carrier has made the same choice. Southwest, Engadget reported, has built a plugin that lets customers book through ChatGPT.

That context does not undercut the security case, but it does matter for anyone reading United’s terms. A restriction that protects customers and a restriction that protects distribution control can be written the same way. Customers and regulators will eventually judge them on whether the promised “secure technology integrations” appear. Airline data practices already draw scrutiny on pricing, and agent access is likely to become the next point of tension.

What businesses facing AI agents should take from this

Most consumer-facing companies will have to make a similar decision soon. A practical sequence:

1. Find out who is already on your platform. Review bot and session telemetry for automated logins, headless browsers and agent user-agent strings. You cannot govern traffic you have not identified.
2. Decide which actions need a human. List legal attestations, consent capture, high-value purchases and account recovery. Those are the steps where agent access creates the most legal risk.
3. Write the policy down where customers can find it. United’s help page is a good model. It sets out a definition, examples of safe and unsafe prompts, rules for existing bookings and an exception for assistive technology.
4. Offer a sanctioned path, or say when one is coming. Scoped, token-based delegation with audit logs is safer than password sharing. A block with no alternative tends to push users toward workarounds.
5. Update your terms and your incident playbook. Decide in advance how you will handle a disputed purchase made by an agent, and what customers should do if they think an agent misused their account.

Frequently asked questions

Can travelers still use ChatGPT or similar tools to plan a United trip?

Yes, for research. United says AI planning is fine as long as the tool does not access united.com or the United app and the traveler does not share sensitive account details.

Will United cancel tickets an AI agent already booked?

Not if they were booked before November 11, 2026, according to United’s help page. It recommends checking that those bookings were ticketed correctly.

Does the policy affect screen readers and other accessibility tools?

No. United says assistive technology for customers with disabilities is not affected.

Is United banning AI agents permanently?

United describes the restriction as a step taken until secure, standardized integrations exist. It says it does not work with any third-party agents “yet” and will update its page if that changes.

A boarding pass for bots

United has not rejected AI agents outright. It has said they cannot enter without proper credentials, the way a passenger cannot board without a boarding pass. The industry now needs to define those credentials: delegated access that can be revoked, purchase authority with clear limits, and an audit trail both sides can rely on. Companies that build that system will be ready when customers want an agent to book for them.