United Airlines has announced plans to restrict AI agents' access to its digital platforms, citing data security and regulatory risks.
The US-based carrier said that it would limit the ability of AI bots to access its digital channels, according to Reuters. The decision marks the latest instance of pushback against AI agents, which are increasingly able to plan and book trips on behalf of travellers.
The restrictions will apply both directly, through United's own digital platforms, and indirectly, through travel agencies and aggregators. As part of this approach, the airline plans to update its booking, ticketing, and distribution policies.
Security and regulatory concerns
United's position centres on the risks of customers sharing account credentials with third-party AI assistants. According to the airline, this practice could expose sensitive information and result in unintended purchases, changes to customer accounts, or the unauthorised use of frequent-flyer miles.
The carrier also pointed to regulatory exposure linked to automated tools carrying out tasks such as flight check-in. This step requires a human acknowledgement relating to prohibited items, including explosives. Delegating it to an AI tool could, according to United, create regulatory risks.
In addition, through the process of extending the measures to travel agencies and aggregators, United is addressing agent activity not only on its own channels but also across the intermediaries through which its fares are distributed.
Divergent industry approaches
United's move reflects a wider divide in how companies are responding to the growth of AI agents capable of carrying out tasks for users. Some businesses are restricting access to protect their platforms, while others are pursuing partnerships.
In retail, the split is visible in responses to Muse, the AI agent launched by Meta in September 2026 with the ability to access other apps, send emails, and make payments. Amazon has blocked Muse, while Walmart has partnered with Meta on the agent.
The travel sector shows similar variation: online travel companies, including Expedia and Booking are working with OpenAI, the developer of ChatGPT, placing them among the businesses opting to work with AI agents rather than limit them. United's decision places the airline on the other side of this divide.
Implications for agent-initiated commerce
The concerns United has raised, namely credential sharing, purchases the account holder did not intend, and the misuse of loyalty balances such as frequent-flyer miles, relate directly to how agent-initiated transactions are authorised and attributed. The check-in example adds a compliance dimension, as some steps in the travel journey require a confirmation from the passenger rather than from software acting for them.
The planned changes to booking, ticketing, and distribution policies indicate that United is treating AI agent access as a matter for its commercial terms with intermediaries as well as for its own platforms.
As AI agents take on a larger role in trip planning and booking, the contrasting positions adopted by airlines, online travel companies, and retailers point to an open question over whether merchants will grant these agents access to their channels or restrict it.
