United Moves to Restrict AI Agents From Booking Flights, Citing Security and Check-In Rules

United Airlines is moving to restrict AI agents from booking flights through its website, third-party travel agencies and flight aggregators. The policy shift puts a firm boundary around “agentic” AI: software that does more than answer a question or summarize information, instead taking actions on a person’s behalf.

For travelers, the distinction is important. Asking an AI tool to organize possible itineraries is one thing. Allowing it to access an account, spend money, apply loyalty miles or advance through check-in is another. United’s position is that the latter creates security, privacy and regulatory problems that the airline does not want automated agents handling.

The move also lands in a broader corporate pushback against AI agents operating inside consumer services. JPMorgan Chase and Amazon are among the other businesses that have sought to block agents from using their products, reflecting unease over exactly who is acting, what data they can access and how easily an automated system can make an irreversible mistake.

What United is restricting

United’s planned policy changes target AI agents completing flight bookings, rather than the general use of AI to research travel. That means the key issue is not whether someone can use an assistant to compare routes or turn a loose request into a travel checklist. It is whether the tool can carry out the transaction and associated account actions.

That boundary matters because booking is rarely a single, isolated click. A flight purchase can involve personal details, payment credentials, contact information, frequent-flyer balances and subsequent modifications. An error may not simply produce a bad recommendation; it could buy an unwanted ticket, alter an account or consume MileagePlus miles.

United specifically warns that sharing login credentials or payment information with an agent can expose sensitive data and lead to unintended purchases, account changes or use of MileagePlus miles. Those are concrete harms with a very different consequence from receiving an inaccurate text response from a chatbot.

Agentic AI, explained

An AI agent is generally a system designed to pursue a task through a sequence of actions. In a commerce setting, that could mean searching options, selecting an itinerary, signing in, entering traveler information and attempting payment. The appeal is clear: fewer manual steps. The risk is that the software may be delegated authority over actions that have financial, personal or legal significance.

There is a meaningful difference between providing an assistant a narrow prompt and giving it credentials. A daily news summary, for example, does not require a tool to control a bank card or airline account. An automated booking flow may require both sensitive information and the ability to decide which choices are acceptable. The more authority an agent receives, the greater the stakes if it misunderstands a preference, behaves unexpectedly or exposes data.

That is why “AI can help plan” and “AI can transact” should not be treated as interchangeable ideas. The former can remain an advisory role under the traveler’s review. The latter can turn the system into an actor that affects the traveler’s money, plans and account.

Why airline rules complicate automation

United also says a fully agent-led booking or check-in process could conflict with Department of Transportation and Federal Aviation Administration requirements. Airlines do not only sell seats; they administer procedures where passengers must personally make declarations.

The airline points to the check-in requirement for a human to acknowledge that their baggage does not contain explosives. That is not merely a form field for software to click through. It is a representation made by the passenger, and it illustrates why automated convenience can run into a hard compliance boundary.

In practical terms, an agent may be able to help someone prepare for travel, but it cannot necessarily replace the traveler at every stage. A system can present a reminder or summarize what a user needs to do; that does not mean it can truthfully make a required acknowledgment in the person’s place.

This is one of the central limits facing agentic commerce. Many online purchases are designed as consumer choices that can be confirmed with a button. Travel includes additional processes tied to identity, safety and passenger declarations. Even an otherwise capable purchasing agent may encounter steps that require direct human participation.

Security, privacy and the cost of a wrong action

United’s concerns are not abstract. A tool that has account access can potentially see or change information beyond the immediate flight search. Loyalty programs add another layer: miles have value, and an unintended redemption can be as disruptive as an unintended charge.

Privacy is similarly central. Credentials and payment details are particularly sensitive because their exposure can extend beyond one transaction. The concern is not limited to a traveler selecting the wrong departure time. It includes what happens when an agent is trusted with enough information to log in, access stored details or make account-level changes.

The recent example involving Meta’s Muse, in which a user’s address was leaked online, is a reminder that agent-related failures can have real consequences. It also helps explain why companies may prefer to restrict automated access before these systems become routine intermediaries in transactions.

For consumers, the sensible dividing line is straightforward: treat tools that can spend money, use points, alter reservations or access accounts differently from tools that only generate information. Convenience does not erase the need to understand what access has been granted or what authority the system has to act.

United does not want another middle layer

Security and compliance are only part of the story. United chief executive Scott Kirby has expressed skepticism about agentic commerce as a business model, saying he does not want to create another middleman. That frames the decision as a question of the airline’s relationship with customers as well as technical risk.

Airlines already operate through a mix of direct booking, travel agencies and aggregators. A consumer-facing AI agent could add yet another party between the traveler and carrier. From a company’s perspective, that intermediary may complicate communication, responsibility and customer support when a booking does not go as expected.

It could also make disputes harder to untangle. If a traveler’s instruction was ambiguous, an agent selected a flight, and the airline processed the booking, the practical question becomes who owns the mistake. Restricting the agent before it completes the purchase keeps the final decision closer to the person paying for the trip.

Not every airline is taking the same route. Southwest has created a plugin that allows users to book flights with ChatGPT. The contrast shows that the sector has not settled on one universal answer. Some businesses see an opening to make AI a booking channel, while others see enough uncertainty to keep agents at arm’s length.

Adoption numbers suggest the agent-commerce rush is still small

There is also little evidence in the available figures that consumers have broadly embraced agents for purchases. During a third-quarter earnings call, Uber said it handled 320 million trips and deliveries in the Halloween week. AI agents accounted for 500 Uber Eats orders and four rides.

Those figures do not establish the total size of the market, but they do provide a useful snapshot: AI-driven transactions represented an extremely small slice of a very large volume of trips and deliveries. The technology may be highly visible in product demonstrations and industry discussions, yet visibility is not the same thing as habitual consumer use.

That gap makes sense. Most people can understand the upside of asking an AI to surface options. Delegating a purchase requires more trust: trust that the system understood the request, selected the right product, protected private data and did not make a choice the user would regret. In travel, where a wrong itinerary can affect work, family plans or a time-sensitive connection, that trust threshold can be especially high.

AI’s role in consumer technology is still developing across other sectors as well. The use of AI in games has its own set of questions around implementation, consent and transparency, as seen in the discussion around AI-retouched voice work in The Witcher 3: Songs of the Past. The common thread is not that every AI use is equivalent, but that the details of who consents, who controls the outcome and what is at stake matter enormously.

What travelers can take from the policy change

United’s approach reinforces a practical expectation: travelers should anticipate that AI may be useful for planning, but not permitted to finish every step of a booking or check-in journey. Even where an agent can search and recommend, a person may need to take over to sign in, pay, redeem miles, review terms or make required declarations.

• Keep account credentials private: Do not treat an AI agent as automatically safe to receive airline logins or payment information.
• Review all itinerary details yourself: Dates, airports, names, baggage choices and fare rules can all matter before purchase.
• Protect loyalty balances: MileagePlus miles and similar rewards have value and should not be delegated casually.
• Expect a human check-in step: Safety-related acknowledgments are not tasks an automated agent can simply make on a passenger’s behalf.
• Separate research from authority: A tool may help narrow choices without being authorized to execute the decision.

For now, United is drawing a line in a place where an AI assistant becomes more than an assistant. The airline is not treating flight booking as a frictionless task to hand over to software, particularly when the process can touch money, identity, rewards accounts and required passenger declarations. Whether other carriers follow that model or build more formal AI-booking integrations, the immediate message is clear: automation may help plan the trip, but the traveler remains responsible for the trip itself.