United Will Block Third-Party AI Agents From Booking Flights. If Your Product Is an Agent That Acts on Someone Else's Site, Plan for the Door Closing.
United Airlines said on Wednesday, November 11, that it is updating its booking and ticketing policies "to prohibit use by unauthorized, third-party personal AI agents or assistants." The restriction applies to making reservations on behalf of travelers, and United says it will apply it both on its own digital platforms and indirectly through travel agencies and aggregators. If you are building, or thinking about building, an agent that books, buys or files things on other companies' websites, this is the second big signal in a month that those companies get a vote.
What United said, and what it left out
CBS News carried United's statement. The reasons are about credentials and liability. United says "sharing account credentials with personal, third-party, AI assistants can expose sensitive information," and that agent actions "may result in unintended purchases, account changes, or use of MileagePlus miles." It also says agents could run into federal rules, with check-in as the example: a traveler has to confirm in person that their bag has no banned items, and an agent can't do that for them.
What United didn't say matters as much. No effective date. No detail on enforcement: terms of service, bot detection, account suspensions, or some mix. No named agents. And no mention of an official path, such as a partner API or United's own assistant, for agents that want to do this properly.
There's also a tension in the coverage. An analyst quoted by CBS, Henry Harteveldt of Atmosphere Research Group, said United wants to avoid "yet another, and potentially even more powerful, intermediary," and that fares remain bookable through Kayak, Hopper and Google Flights. United's own wording mentions restricting agents indirectly via agencies and aggregators. Until United publishes the policy text, I'd treat the exact scope as unknown.
This is a pattern, not a one-off
United is not the first to close the door. In September Amazon started blocking Meta's Muse agent about 12 days after it launched, with a popup saying continued access by an unauthorized AI agent violates its Conditions of Use. Amazon's lawsuit against Perplexity over its Comet browser has been running since November 2025. JPMorgan Chase confirmed it blocks external agents acting for retail customers, while still allowing read-only data through providers like Plaid. Schwab's CEO said it blocks agents trying to move client money "tens of times a week," and Schwab is building its own controlled access instead. Yelp disallows crawling by default and licenses its data to the AI companies that pay.
Delta is a softer case. Some reports said Delta was blocking agents, but Delta's spokesperson said only that it has no partnerships allowing third-party agents to book, and that it is still evaluating the technology. I wouldn't call that a ban. In practice, users report booking agents getting rejected anyway.
Put together, the businesses with the most valuable transactions (money, travel, retail) are drawing the same line. Read access is often fine. Acting on an account is not, unless it goes through a channel they control.
What this means if you build agents
The indie version of the agent dream is a tool that logs into sites on the user's behalf and gets things done. Book my flight, rebook when it's cancelled, move my points. It demos beautifully. It also depends on every site in the chain tolerating you, and the biggest ones are telling you they won't.
There are three ways I see to build on firmer ground:
- Use permissioned APIs where they exist. Payments through Stripe or Plaid, calendars through Google and Microsoft APIs, commerce through Shopify's agent channels. Narrower than scraping, but nobody can switch you off with a popup.
- Act on the user's own data and stop at the handoff. An agent that finds the best fare, fills a draft and hands the user a link to confirm on United's site is a research tool. United has no reason to block it, and the user's credentials never touch your servers.
- Get the partnership before you need it. Southwest lets ChatGPT users view its inventory. That kind of deal is slow and rarely available to a one-person company, but if your product only works with one big partner, start that conversation early.
The fourth option is to keep scraping and hope. I've watched enough indie products die on someone else's platform change to treat that as a bet.
Where I could be wrong
The counter-argument is that blocks like this rarely hold. Meta's response to Amazon, roughly "turning away a personal agent means turning away the customer behind it," is a real argument, and consumer demand has forced platforms to open up before. If agent traffic becomes a meaningful share of bookings, airlines will build an agent channel and charge for it, just as they did with distribution systems. That could happen inside two years.
But that future still favors builders with permission. The open channel, when it arrives, will have terms, fees and approval steps. An agent that spent 2026 evading bot detection will not be first in line for it.
What I'd actually do
If you have an agent product that logs into third-party sites, list every site it acts on and sort them by how bad it would be if each one blocked you tomorrow. For the top one, write down the fallback today: a permissioned API, a handoff link, or a partnership request. If there is no fallback, that site is a dependency you don't control, and your pitch should say so.
Author
Lukas
@lukcombinator