United Airlines curbs personal AI agents over data and regulatory risk

By Amara Osei

United Airlines, the $59 billion airline and the world's second-largest carrier, said on Wednesday it would restrict unauthorized third-party personal AI agents, making it the latest enterprise to block customer bots.

The policy covers direct access on United's digital platforms and indirect activity through travel agencies and aggregators. United updated its booking, ticketing and distribution policies, following similar moves by Walmart, Target and Amazon.

What risks drove United's decision?

United cited three risk categories:

• Data leakage: Sharing credentials with a personal assistant can expose sensitive customer information.
• Commercial errors: Bot actions can cause unintended purchases, account changes or use of MileagePlus miles.
• Regulatory breaches: Automated actions may violate FAA and DOT rules, including human acknowledgment at check-in that bags contain no explosives or other banned substances.

United said leaders in banking and retail had taken similar action and encouraged peers to consider measures that preserve customer data and security while strengthening safety.

United left the door open for authorized tools. “As personal AI assistants evolve, United will continue to evaluate how these tools interact with our services, with a focus on protecting our customers,” it said.

Industry observers see no common standard for supporting a growing bot population from major AI vendors and startups. Each new agent strains IT resources, while enforceable industry standards could persuade enterprises to reconsider their bans.

United has made bot access conditional on authorization and compliance, not permanently off the table.

What changes for customers and agents?

Because bots use customer credentials, their activity often appears identical to a human customer's. Analysts call dedicated bot credentials the cleanest fix.

Last month, Walmart announced a program scheduled to start this month to separate bot from human actions. It said customer and agent purchases currently appeared together, without differentiation.

Walmart's “Agent Profiles, launching in the next month,” will let customers authorize each AI agent through a dedicated profile and see that agent's purchases separately from the rest.

Target chose a narrower route in recent terms-and-conditions changes. It permits only its AI Shopping Assistant, OAI, Google and Microsoft, and may alter the approved list at any time in its sole discretion.

Target calls other agentic-commerce tools “unauthorized, expressly prohibited” and bars them from accessing, logging into, scraping, querying or gathering site data through direct or API-based means, automated credentials or other methods. Approved agents cannot operate with unauthorized ones without written approval.

The immediate result is a split market: some retailers isolate agent activity, while others reserve access for a short list.

Will blocking bots reduce their value?

Analysts and consultants expect more enterprises to block external bots, but they disagree on the effect on autonomous purchasing, ticket ordering and concierge services.

Dickson Research principal analyst Frank Dickson said: “Blocking does not destroy the value of agents. It moves it. Every wall eventually gets a gate. The gate charges admission.” He expects agent access to return through channels the enterprise controls, on its terms.

Dickson said, “Whoever owns the agent owns the customer relationship.” Airlines have spent years pulling customers back from third-party travel sites, he said, and will not surrender that relationship to another chatbot.

Dickson framed the issue as unassigned liability: “Enterprises do not fear bots. They fear liability that nobody has assigned.” Rules specifying which steps humans or agents may perform, and how each action is recorded, could let general counsel sign off on deployments. Ambiguity keeps bots stuck in pilot.

He also warned that “A sea of agents is a sea of requests. Somebody pays for every one.”

Each agent may bring its own login method, approval logic and record of activity—if it keeps one—forcing an airline to build a separate door for each. He said bots that repeatedly check prices do not buy more seats. United's caution remains a reasonable risk decision until the market settles.

Digital 520 principal consultant Noah Kenney saw little downside for United: “United is in a position where there is substantial risk, an uncertain commercial upside, and almost no competitive pressure to accept either.” He expects the carrier to wait until legal consequences become more predictable.

Restrictions may channel agents into controlled systems, but unclear liability and unlimited integration costs keep many deployments in pilot.

What limits do enterprises need?

Kenney's main concern is excessive access. “One of the biggest mistakes I see in enterprise AI deployments is giving agents access to far more information and systems than their responsibilities actually require,” he said.

He distinguished an agent instructed to reach one system from one technically incapable of reaching anything else: “We shouldn't be giving agents broad capabilities and hoping they exercise restraint.”

Acceligence CEO Justin Greis expects more companies to restrict bots while they establish controls. He warned that widespread blocking would reduce agents' value by preventing them from completing tasks across services.

Greis also called for customer training. Actions authorized through an agent can create obligations even when the customer never clicks “buy,” “send” or “confirm,” he said. He expects a substantial cultural shift, comparing agents to saying things online that one would not say face to face, as agents widen the gap between choices and responsibility.

Enterprises will keep bots out until permissions, technical limits and customer accountability become explicit.