United Airlines blocks AI agents from booking flights over cybersecurity and compliance risks

United Airlines is moving to block AI agents and autonomous assistants from booking flights or managing reservations on customers' behalf, citing cybersecurity risks and potential conflicts with federal regulations. According to TechCrunch, the restrictions were announced on November 12, 2026, and will apply both to United's own digital platforms and to indirect channels such as travel agencies and aggregators.

What United is changing

In a statement quoted by TechCrunch, the airline said it is "taking steps to restrict access — directly within our digital platforms and indirectly via travel agencies and aggregators — to prohibit use by unauthorized, third-party personal AI agents or assistants." The company added that the effort includes updates to its booking, ticketing and distribution policies.

The breadth of that approach matters. Rather than simply detecting automated activity on its own website or app, United is pushing the restriction through the intermediaries that sell and distribute its tickets, which could reach agents no matter how they attempt the booking.

The security argument

United's first concern is credential sharing. The airline warned customers that handing account logins to personal, third-party AI assistants can expose sensitive information, and that actions taken by such tools "may result in unintended purchases, account changes, or use of MileagePlus miles."

As TechCrunch notes, airlines and banks currently have difficulty distinguishing genuine customers from AI systems acting for them, typically because users hand their logins to those assistants. Credentials shared this way become a liability if they are leaked or exposed.

The regulatory argument

United's second concern is compliance with federal aviation rules. The airline pointed to requirements that a human complete flight check-ins, including acknowledging that their bags do not contain banned substances. An agent performing that acknowledgment on a passenger's behalf could leave the passenger, or the airline, on the wrong side of the rule.

Part of a broader corporate pushback

United is not acting alone. TechCrunch reports that it is only the latest large American company to prevent customers from using AI agents and autonomous assistants to access its systems. The announcement follows warnings from banks, including Bank of America, which the previous week advised customers against giving their passwords to AI assistants.

Why it matters

The standoff goes well beyond one airline. AI assistants are increasingly capable of completing real-world tasks end to end — browsing, filling in forms, paying — but the services they touch were designed for human users, not delegated ones. Companies in that position face two unattractive options: tolerate agents operating with borrowed logins and accept the fraud and liability exposure, or lock the agents out and deny customers the convenience of delegation.

United has chosen the second path, and its decision to extend the restriction through agencies and aggregators shows how a single provider's policy can ripple across an entire distribution chain. If airlines and banks hold this line, agent developers may have to negotiate formal, authenticated access — much as app ecosystems evolved APIs and partner programs — instead of relying on software that simply uses its owner's credentials. Until such channels exist, expect more service operators to treat autonomous agents as a security problem to contain rather than a customer segment to serve.