No Bots on Board: United Airlines Blocks AI Agents From Booking Flights Over Security Risks
United Airlines officially banned autonomous artificial intelligence agents from booking flights or managing passenger reservations across its digital systems. The major American carrier announced the restriction to protect customer accounts from cybersecurity threats and prevent automated software from violating strict federal aviation regulations. By blocking third-party AI tools, United joins a growing wave of enterprise companies pushing back against automated software bots acting on behalf of everyday consumers.
Large corporations across the travel and banking sectors face mounting operational headaches as consumers adopt autonomous AI assistants. Currently, backend security systems struggle to distinguish between a human passenger logging into their account and an automated AI bot executing tasks using that customer’s saved login credentials. When travelers hand over account passwords to external AI applications, those credentials sit on third-party servers, creating serious security exposures if hackers breach the AI provider.
In a public warning to customers, United pointed out that sharing MileagePlus account logins with personal AI assistants puts sensitive personal records and payment methods at risk. Autonomous tools operating without direct human supervision can also trigger costly mistakes, including accidental ticket purchases, unauthorized itinerary changes, or unintended spending of accumulated frequent flyer miles. Once an automated script executes a transaction using valid user credentials, reversing the charges or recovering spent loyalty points creates complex disputes for both customers and airline support teams.
Beyond financial and cybersecurity risks, automated flight management directly conflicts with federal aviation safety laws. United highlighted that federal rules require a real human passenger to complete the flight check-in process personally. During check-in, travelers must legally confirm that their checked and carry-on bags do not contain hazardous materials or banned substances. Allowing an AI agent to click through check-in prompts automatically undermines regulatory compliance and creates legal liability for the airline.
To enforce the ban, United is rolling out technical blocks across all booking channels. The airline confirmed it will restrict unauthorized third-party AI agents directly on its website and mobile app while also blocking indirect automated access coming through online travel agencies and flight aggregators. Alongside technical filters, United updated its official booking, ticketing, and distribution policies to explicitly prohibit automated personal assistants from interacting with its reservation infrastructure.
United’s crackdown mirrors similar warnings issued by major financial institutions. Just last week, Bank of America urged its banking customers never to share account passwords with personal AI assistants, citing fraud risks and credential theft. Both banks and airlines rely on verified user identity to prevent fraud, process high-value transactions, and satisfy federal regulators.
The clash between consumer AI agents and legacy corporate security systems highlights a major bottleneck in agentic software adoption. Until AI developers and enterprise platforms agree on secure authentication standards that grant bots limited permissions without requiring raw user passwords, major service providers will continue locking automated assistants out of sensitive customer accounts.
