United shuts the door on AI agents: they can no longer book flights on its site
United just wrote into its contract of carriage that no AI agent may book, change or pay for a ticket on your behalf. It is the first major US airline to turn AI agent access into a clause, and that matters more than the measure itself.
The announcement came on Wednesday, November 11, 2026. It did not arrive as a technical patch or a silent block: it arrived as contractual text a passenger accepts at checkout, backed by a press release and an update to the airline's booking, ticketing and distribution policies.
What changed on November 11, in United's own terms
United amended its contract of carriage, the document that sets the conditions a passenger agrees to when a ticket is issued. Under prohibited practices it added a short line: using AI agents to make, modify or service a ticket, or to purchase any service or product, is now off limits.
The interesting part is the definition. For United, an AI agent is any software or service that takes autonomous or semi-autonomous action, with or without human supervision, to discover, search for, book, purchase, ticket, service or manage a United product on the passenger's behalf or at their instruction. The definition lists three families: assistants built into social, messaging or search platforms; AI-enabled browsers and standalone agents; and third-party assistants that reach United through a tool or connection supplied by a travel agency or another intermediary.
Read also
The press release adds the operational scope: the airline says it is restricting access both inside its digital platforms and indirectly through travel agencies and aggregators, to prohibit use by unauthorized third-party personal AI agents or assistants. United does not publish how it will detect those agents or which user agents it will inspect, so two things should be kept apart: there is a written policy, and there is a control mechanism still to be built.
The three arguments the airline gives
The first is passenger account and data security: an agent that enters with someone's session handles information that does not belong to it. The second is the operational risk of a booking made with no human in the loop, one that can produce changes or incidents that are hard to undo afterwards. The third, cited in USA Today's coverage, is compliance with federal aviation and transportation rules, with the FAA and the Department of Transportation in the background.
The real problem: an agent posing as you
None of those three arguments names the actual problem, which is identity. When an agent books in your name it presents no credential of its own: it uses your session, your account and your card. On the other side there is no way to prove the human approved that fare change, that bag purchase or that cancellation. The site sees a browser behaving like a person because, technically, it is one.
That is the difference between a training crawler, which only reads, and an agent that acts. The first one can be handled with a rule in a file. The second one has to be asked for something that can be verified.
The industry is moving the other way
Delta and American Airlines have not announced an equivalent ban and are still exploring the technology, according to Fast Company. The industry read is that every airline is solving the same problem with different criteria, and that United picked the most conservative one while being the most tech-forward carrier in the US market.
The wider context does not support reading this as a war on AI either. McKinsey QuantumBlack estimates put agentic commerce at a three to five trillion dollar consumer revenue opportunity by 2030. Meta's Muse agent passed ten million accounts in a few weeks. At the same time, agent payment pilots from Visa and Mastercard still require human sign-off: the industry wants agents to buy, but it is not handing them a blank cheque yet.
What it means if you build agents
The first thing that breaks is multi-step booking behind a login. Then award search and fare comparison tools that until now treated an airline website as if it were a public API: the definition explicitly includes AI-enabled browsers and any assistant that arrives through an agency or intermediary connection.
The critical reading of the wording belongs to One Mile at a Time, not to United: if "discover or search" falls inside the definition, the clause could reach award search tools and other automated businesses. That is a reasonable reading of a broad clause, and it should be quoted as exactly that, a reading.
The existing way out is not new: official APIs and accredited distribution. The key word in the announcement is "unauthorized". United is not banning agents forever, it is banning the ones that do not come through a channel the airline controls. If you build on someone else's website, that is the message: a product that depends on an interface designed for humans depends on a door that can be closed. If you work through open protocols between applications, such as MCP, the question moves to who controls the tool rather than whether it exists.
What it means if your site receives agents
Most sites have not made the decision United just put in writing. Not making it is also a decision: letting in anything that can fill a form. There are three paths, and each one has practical consequences.
The first is to allow everything: no friction, no control, and resource consumption that scales on its own. The second is to require identity: logins wherever there is data, API credentials, and every request treated as what it is, a machine talking to another machine. The third is to block, and there the cost shows up on the other side: some AI search traffic looks too much like an agent to filter out without losing real visits.
Before choosing, read your terms of service, look at the logs and decide what you offer an agent that arrives with good intentions. The real question is no longer whether to slow bots down, but who may act on your site and with what proof of identity. That is the subject of the tutorial that goes with this piece: the four layers available today to decide it, with code and with their limits.
Conclusion
Agents are no longer a lab experiment and they now have an access policy, a contract and fine print. What comes next is not a harsher ban, it is verifiable identity: an agent that can prove who it is and on whose behalf it acts. Until that exists, every large site will solve it its own way, and United's version is the first one you can read signed.
If you want to see how a rule like this is enforced from the server side, the blog continues with the technical layers: robots.txt, nginx, middleware and agent signatures.
