United Airlines is tightening its rules around automated booking tools, saying it will restrict AI agents and other autonomous assistants from booking flights or managing reservations on behalf of customers. The airline says the change is meant to reduce cybersecurity risks and avoid conflicts with federal aviation rules, making it one of the latest major U.S. companies to push back against software agents acting in users’ place.
United Airlines moves to block AI agents
In a statement, United said it is taking steps to restrict access to its systems “directly within our digital platforms and indirectly via travel agencies and aggregators” in order to prohibit use by unauthorized, third-party personal AI agents or assistants. The company said the effort includes updates to its booking, ticketing and distribution policies.
The airline’s concern is not simply that AI tools can make purchases. It is that those tools may operate using customer credentials, creating a layer of access that can be difficult for companies to verify. United said that “sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles.”
Why the airline says AI assistants create a security risk
The broader issue is becoming familiar across industries: businesses are trying to tell the difference between a real customer and an AI system acting on that customer’s behalf. If a user gives an assistant access to login details, the company receiving the request may not be able to know whether the action was manually approved in the moment or carried out automatically after the fact.
That matters because shared passwords can be exposed if an app, browser extension or assistant is compromised. The airline is effectively arguing that a credential handed to an AI agent is still a credential, and that the security risks do not disappear just because the software is acting in the customer’s interest.
United’s warning also reflects a more traditional cybersecurity concern: once a third-party tool is inside an account, it may be able to trigger changes the customer did not intend. That could include booking the wrong itinerary, altering reservation details or spending loyalty points unexpectedly.
The federal rules angle
United also said the move is meant to help avoid problems with federal aviation regulations. The company specifically pointed to situations where a human is required to complete a flight check-in and confirm that bags do not contain prohibited substances.
That part of the policy suggests the airline is not only worried about account security, but also about compliance. If a customer hands off the process to an AI agent, the airline said, there is a risk that required human acknowledgment could be bypassed or obscured.
United did not say in the material provided that AI booking is illegal. Instead, it framed the issue as one of managing access, limiting unauthorized use and aligning its digital operations with the rules that govern air travel.
A growing backlash from major companies
United is the latest large American company to set limits on AI agents accessing user accounts. Banks and airlines are among the sectors most exposed to the problem because their services rely heavily on logins, identity checks and transaction controls.
The concern has already reached the banking industry. Last week, Bank of America urged customers not to share their passwords with AI assistants. That warning underscored how quickly financial firms are moving to discourage credential sharing, especially as more consumers experiment with tools that can browse, click and fill out forms on their behalf.
For airlines, the stakes are different but related. Booking systems involve personal information, loyalty balances, payment details and travel plans. That combination makes them attractive targets for misuse, whether by malicious actors or by helpful tools that overreach.
Companies in these sectors are now being forced to make a judgment call: how much automation should be allowed when the line between a user and a user-controlled agent is blurry? United’s answer, at least for now, is that the safest approach is to restrict it.
What the policy may mean for travelers
For travelers, the practical takeaway is straightforward: United wants customers to book and manage trips through approved channels without handing their login details to a third-party AI assistant. If an AI tool is using a customer’s credentials to search, purchase or modify a reservation, the airline is signaling that it may block that access.
That could affect a range of use cases, from itinerary planning to automatic check-in reminders. It may also limit some third-party travel services that rely on account access to manage bookings in the background. The airline’s statement suggests the policy is broad enough to cover not just direct use within United’s own digital platforms, but also indirect access through travel agencies and aggregators.
The move is likely to create tension with users who increasingly expect software to do routine tasks on their behalf. At the same time, airlines have little incentive to accept ambiguity around who is actually operating an account, especially when loyalty balances, payment information and regulated safety steps are involved.
Why this issue is spreading beyond aviation
United’s decision reflects a wider industry shift. As AI assistants become more capable, companies are being asked to decide whether those systems should be treated as enhanced tools for customers or as separate actors that need to be controlled, authenticated or blocked.
That question is especially urgent in services where small mistakes can have outsized consequences. A misfired hotel booking can be annoying; a mistaken airline reservation can be expensive, time-sensitive and difficult to unwind. Add federal rules, security-sensitive account data and potential identity exposure, and the appeal of caution becomes clear.
For now, United is taking the conservative route. The airline appears to be drawing a bright line between human-controlled booking and automated access that operates through shared credentials. Whether other airlines follow with similarly explicit restrictions may depend on how quickly AI assistants become embedded in everyday travel.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More AI & Automation Tech News
Last Modified: November 12, 2026 at 10:32 pm
0 views
