United Airlines has announced a policy update that will stop AI agents and third-party assistants from booking flights or making reservation changes on behalf of users. The company says allowing these tools to use shared login credentials poses significant cybersecurity risks and may even breach federal aviation safety rules. United is rolling out changes across its digital platforms as well as via travel agencies and booking intermediaries.
Why United Takes Action
Airlines and financial institutions are increasingly worried about systems that aren’t clearly human interacting with their platforms. United sees several specific dangers in the use of AI agents when customers share credentials: unintended purchases or changes to accounts, misuse of loyalty miles, exposure of sensitive personal data. These concerns are magnified by potential violations of regulations that require user-attested compliance—for example, ensuring that checked baggage doesn’t contain prohibited items, or that passengers personally confirm legal declarations when checking in.
United believes that by preventing unauthorized AI tools from accessing its booking and ticketing systems, it can reduce cybersecurity incidents and maintain adherence to rules set by aviation authorities. The company has already begun updating its booking, ticketing, and distribution policies to reflect these protections.
Broader Industry Risks & Precedents
The move by United follows similar advisories from major banks cautioning customers not to share passwords with personal AI assistants. Financial institutions have flagged password sharing as a significant security lapse, one that could lead to fraud or data exposure. United’s approach reflects an industry-wide tension: enabling convenience through AI, while guarding against misuse or regulation breach.
This demonstrates a growing trend among airlines and service providers to enforce stricter authentication. As digital tools evolve, organizations are scrambling to build policies that distinguish between human users and AI-mediated interactions, especially when serious risks are at stake.
For customers, this change may require more direct interaction when booking or managing flights—tools like AI agents will no longer handle certain tasks. United’s statement indicates both direct controls on its online platforms and indirect measures through travel agents and aggregators.
Enforcement is expected to focus on preventing shared credentials, detecting unauthorized third-party systems accessing user accounts, and ensuring the human user is the one who completes actions covered by legal or safety obligations. The full scope of technical measures has not been publicly detailed.
United’s new policy takes effect immediately. That means customers using AI agents to manage bookings may need to adapt—and providers of such AI assistants will have to ensure they comply with United’s updated rules or block certain functionalities.
What this change means beyond United is that the tension between automation and accountability is reaching airlines. The policies laid down here may set precedents on what kinds of automation service providers allow customers to use, especially when federal compliance and safety are involved. Other industries will likely watch closely to see how this issue plays out in practice—and where enforcement lines are drawn.
