United Airlines blocks AI agents from booking flights over cybersecurity risk

United Airlines said it will not allow customers to use AI agents to book flights or manage reservations, citing cybersecurity risk. TechCrunch reported the decision.

The stance means AI agents that can browse the web, fill forms and complete payments on their own have run into an explicit refusal from a major airline in a high-frequency consumer scenario.

The wording is blunt: the carrier will not let customers use AI agents to book flights and manage reservations. That covers more than placing an order — it includes looking up, changing and cancelling bookings, all of which require entering an account.

Cybersecurity is the stated reason, but what is really being redrawn is who is allowed to act on a customer's account. Letting a third-party agent log in, store credentials and execute transactions widens the attack surface and blurs who is responsible when something goes wrong.

As browser-operating AI agents spread quickly, airlines, banks and retailers all face the same tension between automation-driven efficiency and account security, fraud prevention and terms of service.

For an airline the risk-reward balance is lopsided. Agents add limited incremental bookings, while account takeover, misticketing or mass scraping lands the cost and legal exposure back on the carrier.

Three things to watch: whether other airlines follow with similar limits, whether agent vendors can offer verifiable identity and user-authorization mechanisms, and whether regulators set clear rules for agents acting on a user's behalf.