Your AI assistant can research flights, compare fares, and pick a seat. What it can no longer do — at least on United — is actually buy the ticket. This week United Airlines became the first U.S. carrier to say it will block unauthorized third-party AI agents from booking flights on its own platforms, and from doing it through travel agencies and aggregators.
On the surface that sounds like a routine tech-policy shrug. It is not. It is one of the first times a major regulated service has drawn a hard line between an agent that can look and an agent that can act — and the reasons United gave are a preview of every argument we are about to have about agentic commerce.
What United actually said
United announced the policy on Wednesday, November 11, in a statement that cited two problems. The first is credentials. To make a booking, an AI agent needs access to your account — your login, your payment details, your MileagePlus miles, your passport data. In United’s words, “sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles.”
The second problem is regulatory. Federal rules require a passenger to confirm, at check-in, that their checked bags do not contain banned items such as explosives. United’s point is that an automated agent cannot make that attestation on your behalf — and neither can it be held to it. The airline said it is “taking steps to restrict access — directly within our digital platforms and indirectly via travel agencies and aggregators — to prohibit use by unauthorized, third-party personal AI agents or assistants,” and that it is updating its booking, ticketing, and distribution policies to match.
Two details matter for anyone building in this space. Agents will still be able to show you United flights and prices — the ban is on completing the transaction, as The Verge reported. And the restriction targets unauthorized agents, which is a meaningful qualifier I will come back to.
The detail that kills the “just let the bot do it” pitch
Read past the press-release language and the real obstacle is a single line about explosives in checked luggage. It sounds almost comic until you sit with it. At check-in, a person legally confirms that their bag does not contain prohibited items. That confirmation is an attestation made by a human who can be held responsible for it.
An AI agent cannot truthfully make it. The agent is not the passenger, it cannot see inside the bag, and it has no legal standing to swear to anything. There is no CAPTCHA that solves this. It is a question of who is accountable when the answer turns out to be wrong — and until a court or a regulator says an agent can act in your name and someone else can carry the liability, this is a wall, not a bug.
The credential problem is the same story wearing a different hat. An agent that holds your airline login holds your money and your miles, and the failure mode is not hypothetical. We have been tracking exactly this class of risk: the $1 billion wake-up call around AI agent security was about what happens when agents get access to systems and credentials they were never supposed to touch, and the hidden cost of AI agents is full of cases where an agent did something its owner never intended. United is not being paranoid. It is reading the same incident reports everyone else is.
Read the fine print: “unauthorized”
Notice what United did not say. It did not say agents will never book its flights. It said unauthorized agents will not — and it said it will keep evaluating how these tools interact with its services “with a focus on protecting our customers.” As Travel Weekly reported, United has not signed any authorization agreements yet, which means the door is closed for now, not welded shut.
That is the most interesting word in the whole story. A gate is an invitation to build a key. What United is asking for, whether it says so plainly or not, is a framework: scoped credentials that expire, a way to identify which agent is acting, an audit trail, and a clear line on who pays when something goes wrong. This is the same instinct we saw when Anthropic cut the internet off from its own agents — the recognition that an agent with too much access is a liability, and that containment is easier than cleanup.
United is not the only one drawing lines
Look around the same news cycle and a pattern shows up. eBay appeared to block AI agents from browsing its site. Several major banks have placed restrictions on agents acting in customer accounts. DoorDash, for its part, said it had received only several hundred orders from AI agents — a reminder that adoption is still early, not that the risk is imaginary.
Not everyone is retreating. Southwest has made its flight inventory viewable to ChatGPT users, letting the AI app pull up its website. United fares will still be bookable through Kayak, Hopper, and Google Flights, so the airline is not making itself harder to find — it is making itself harder to transact with programmatically.
Aviation analyst Henry Harteveldt put the business case plainly: United does not want “yet another, and potentially even more powerful, intermediary” than the ones it already deals with, and flight searches cost airlines money. Blocking bots does not make United cheaper to book. It just keeps the airline from paying for a surge of machine traffic that does not convert into a sale.
The security industry has already noticed the moment. CrowdStrike bought the AI agent security category for $495 million, and the pitch behind that deal is the same one United is making in airline language: agents are coming, and somebody has to control them.
Why this is bigger than one airline
Here is the pattern worth watching. Agentic commerce assumes every service will happily accept an agent acting for you. Regulated services — airlines, banks, healthcare, government — have legal duties that assume a human being is in the loop. Those two assumptions are on a collision course, and travel is simply where they met first.
It is the same argument Satya Nadella made when he called for an emergency brake on AI: if a system can act in the world, it needs a way for a human to stop it, and it needs to keep a record of what it did. United’s version of the emergency brake is cruder — it just says no — but the instinct is identical.
For a country where a great deal of travel is arranged through agencies, group bookings, and family networks, this is more than a Silicon Valley debate. The question of who or what is allowed to make a booking on your behalf is one that will shape how the next wave of travel tools gets built — and who gets left out of it.
What builders should take from this
If you build with agents, or you are thinking about it, three things follow from United’s move.
- Do not treat a saved password as consent. Scoped, revocable credentials are the difference between an agent that acts for you and an agent that can act against you.
- Design for the human in the loop on anything a person must legally attest to. Research, compare, and prepare — then hand the attestation to a human. That is not a limitation of the technology. It is the law.
- Build for authorization, not circumvention. Expect per-service agent policies. The companies that get invited through the gate will be the ones that can prove who their agent is and what it did.
United did not kill the AI travel agent. It made the first serious admission that the agent cannot be the customer. The tools that figure out how to make an agent accountable — not just autonomous — are the ones that will be allowed to book.