United Airlines Blocks Unauthorized AI Booking Agents

Daniel Okafor

United Airlines will block unauthorized third-party AI agents from booking flights and managing reservations, according to a statement announcing restrictions across direct digital platforms, travel agencies and aggregators.

Its cited reasons are credential exposure and federal aviation requirements. The airline cited no disclosed breach or quantified incident.

What exactly is changing?

United said in a statement: "As a result, United is taking steps to restrict access — directly within our digital platforms and indirectly via travel agencies and aggregators — to prohibit use by unauthorized, third-party personal AI agents or assistants."

The policy will operate through three access channels:

• Direct platforms: United will stop unauthorized agents using airline systems for bookings and reservation management.
• Travel agencies and aggregators: The airline will enforce its restriction indirectly through both intermediary channels.
• Policy updates: United will revise its booking, ticketing and distribution policies. Those are three policy sets, although the statement gives no implementation date.

Which risks does United cite?

United warned: "sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles."

The warning names three consequences: unintended purchases, account changes and use of MileagePlus miles. The statement does not quantify incidents or report an AI-agent breach.

The airline and banks are struggling to distinguish real customers from AI systems operating on their behalf, including when users share their logins with assistants. Customers who share logins can expose credentials if those passwords leak or become exposed.

United is the latest American corporate giant to prevent customers from using AI agents and autonomous assistants to access its systems. Its move follows a warning from banks, including Bank of America, which last week urged customers not to share passwords with their AI assistants.

Why do human check-ins matter?

United also warned about federal aviation rules. The airline says those rules require a human to complete flight check-ins and acknowledge that bags do not contain banned substances, a step that automated agents could bypass.

The statement names neither the regulation nor any enforcement case, so the compliance claim remains unexamined in the airline's account. United provides no estimate of how many passengers or check-ins involve AI agents.

What remains unanswered?

The statement gives no effective date, list of permitted agents or technical test for identifying unauthorized access. It also gives no cost estimate for channel partners. That leaves the airline's operational approach largely undefined beyond the policy's stated reach across direct bookings, travel agencies and aggregators.

A prevention policy is not evidence of a measured remediation. The airline reports no financial loss, customer count or security incident tied to AI agents.

The Bank of America warning establishes wider concern about credential sharing, but offers no technical control for travel platforms. United's stated rationale is protection of sensitive data and compliance with human check-in requirements.

The policy direction is clear, but the mechanism, timetable, compliance standard and scale of any disruption across the airline's direct and intermediary distribution channels remain unstated.