News
United blocks third-party agents from booking and servicing tickets
United’s November 11, 2026 rules block unauthorized AI agents from booking or managing travel on its platforms and through agencies, even when a person has given the agent permission. Research that does not access united.com or the United app is still allowed.
United Airlines’ restriction on third-party AI agents is a standing rule dated November 11, 2026. Unauthorized personal AI agents and assistants are barred from United’s digital platforms and from reaching United travel through agencies and aggregators. A customer who has already approved the agent does not change that.
Why United drew the line
The newsroom tied the restriction to account security. Sharing credentials with a personal third-party AI assistant can expose sensitive information. Actions those tools take may result in unintended purchases, account changes, or use of MileagePlus miles.
The regulatory example United gives is automated check-in. Flight check-in requires a human acknowledgment that bags do not contain banned substances such as explosives. An agent that checks a traveler in automatically can skip that acknowledgment and mean missing important safety content. The airline said these automated AI actions have the potential to violate FAA and DOT regulations.
The work includes updates to booking, ticketing, and distribution policies. United is restricting access directly on its digital platforms and indirectly through travel agencies and aggregators, to prohibit use by unauthorized third-party personal AI agents or assistants. It said leaders in banking and retail have taken similar actions, without naming them, and encouraged others to consider measures that protect customer data and strengthen safety.
Permission from the traveler is not permission from United
The help center is direct about supervised use. Giving an assistant access does not mean United will let that assistant transact. “Just because you’ve given access to AI assistants doesn’t mean United will permit an AI assistant to transact with United.”
United treats the delegation itself as the risk. Delegating authority to perform tasks, including accessing a MileagePlus account, booking trips, or buying add-ons and upgrades, is, in the airline’s phrase, “a lot of control.” Granting that access can expose personal information or result in bookings, account changes, or use of MileagePlus miles without the customer’s approval. United says it wants protections for travelers in place first, and it wants standardized, secure integrations with privacy, security, authorization, and accountability before those tools interact with an account or a booking.
What counts as unauthorized is operational, not a brand list. If a third-party AI agent, bot, browser extension, or browser feature searches, books, buys, manages, or collects information on united.com or in the United app, and United has not given permission, it is unauthorized. Research and trip planning remain allowed only if the tool does not access united.com or the United app.
Travel agencies and booking platforms cannot use third-party AI agents to search for, book, or manage United travel for their customers on direct or indirect channels. An agency may use its own third-party AI tools only with United’s permission.
United does not yet work with authorized third-party AI agents. The help center says that if it does, the page will be updated. Assistive technology for customers with disabilities is not affected.
Research yes, credentials no
United’s guidance is to give outside tools general planning information only. Acceptable examples on the page are broad questions: where to travel in the Caribbean in January to avoid a crowd, what to do in New York in May, a list of restaurants in Rome. The page tells people not to hand over MileagePlus numbers, passwords, sign-in information, confirmation numbers, or identity details such as name, birthdate, address, or a phone number to call.
United says some inspiration tools are ones it built. If another tool generates speech or text about a trip, the instruction is to review it and search it yourself on united.com or in the United mobile app. Do not give the agent confirmation numbers, MileagePlus details, or anything you would not want the system to remember or pass to another person or system.
Bookings already made
Agent bookings made before November 11, 2026 will not be canceled. United still recommends reviewing recent travel plans to confirm they were booked and ticketed correctly.
If MileagePlus login information was shared with a third-party agent, United recommends changing the password immediately. If there is suspected unauthorized access, an unintended purchase, or miles used without intent, secure the account through United’s existing account-help steps. The newsroom pointed customers to the Digital Trust Center for what the restriction means, how to protect an account, and where to get help if an agent takes an unintended action.
For anyone building or running an agent that buys or services travel, the practical reading is narrow. Customer approval, a browser extension, or an agency workflow does not create an authorized United integration. Until United says otherwise on its own page, keep agents off united.com and the United app, and treat ticket purchase, account changes, upgrades, and MileagePlus actions as things the person has to do.
Read United’s November 11 newsroom note and the Digital Trust Center page on unauthorized third-party AI agents before wiring any assistant to a United booking or account. If credentials were already shared, change the password and check bookings made before November 11, 2026, rather than assuming they were canceled.