What happened
The Verge reports that United Airlines will not allow personal AI assistants operated by third parties to book tickets on its service. The airline’s position is not a blanket ban on agents interacting with flight information: agents can still show users United flights, but they cannot complete the transaction on the traveler’s behalf.
United says it has not yet seen many people try to use AI agents to book flights. The company nevertheless cites privacy and regulatory concerns. It is concerned that an agent could expose customer information or make a purchase the customer did not intend. The Verge also describes a compliance issue: airlines need to share certain information with customers and obtain attestations, such as confirmation that a traveler’s bags do not contain explosives. United’s position implies that such steps cannot simply be delegated to an agent without protections.
At an event on Tuesday, CEO Scott Kirby said, “To be honest, I don’t want to create another middleman,” according to The Wall Street Journal, as cited by The Verge. The remark frames the decision as more than a narrow technical block: United does not want an outside assistant to become an additional commercial layer between the airline and its customer.
United’s public explanation leaves room for change rather than declaring a permanent prohibition. The company says that third-party agents present opportunities as they advance, but direct interaction with a United account or booking could involve sensitive actions. It wants protections for travelers in place first. The Verge does not say that United has published a specification for those protections.
The immediate product boundary is therefore narrow but consequential: an agent can assist with discovery, while the airline retains the booking step. The Verge places United alongside other businesses restricting unauthorized agents, including eBay and several major banks. No new United agent API, supported transaction flow, rollout date, price, usage limit, or alternative booking integration is described in the article. The reported change is a stated restriction on an emerging mode of access, rather than the launch of a new developer product.
What the archive adds
New Runtime’s earlier coverage on November 8 said Charles Schwab is blocking unauthorized agents from logging in and moving client money, while developing controlled routes through its Charley assistant and MCP integrations. United is a new example, not a new fact about Schwab: both cases put sensitive account actions behind an authorization boundary, while the details of permitted access differ.
Trend signal
This supports the pattern that agent-ready software exposes capabilities: useful agent access need not mean unrestricted control. United’s stated distinction between displaying flights and completing a booking illustrates a company separating information access from an action with financial, privacy, and regulatory consequences. The article does not describe a capability interface or a path for authorized agents, so the example is about the boundary more than an implementation.
Why now
The Verge reports that United has seen few attempts to use agents for flight bookings, yet it is setting a position before this interaction becomes common. That timing matters because consumer assistants are increasingly presented as systems that can complete multi-step tasks, while merchants and regulated services still have to decide which steps can be delegated and which require a traveler’s direct participation.
Connections to other events
The case meets New Runtime’s earlier coverage of Schwab’s restriction on unauthorized agents, but in a different transaction setting. The Verge also reports that eBay appeared to block agents from browsing and that several major banks have restricted agent access. Taken together, these examples show that a consumer-facing agent’s ability to act depends on the service’s own access rules, not only on the agent’s technical ability to navigate a site.
Why it matters
For teams building travel assistants or commerce agents, reliable search is not equivalent to permission to purchase. A booking can disclose personal data, commit money, and require a traveler to make a specific attestation. If a system treats the whole journey as one delegated task, it may cross a boundary the service or the user does not accept.
The practical design implication is to make authority explicit at each consequential step. An agent can gather options, compare itineraries, and prepare booking details, then hand off for identity, disclosures, and final consent where required. The interface should make clear whether the agent is only recommending, filling information, or attempting to commit a transaction.
Product teams should avoid promising end-to-end autonomy until they know which actions the merchant permits and who is accountable for confirmations. United’s position is a company policy, not evidence that every airline will adopt the same rule, but it demonstrates why transaction-capable agents need per-action permissions and clear human confirmation points. This applies beyond travel wherever account access, money movement, or regulated declarations are involved.
What happens next
- More services will distinguish agent discovery from transaction completion. (6 months, 70%). Watch for: published rules that permit search or quote retrieval while requiring a customer-controlled checkout.
- United will describe a controlled route or restate its restrictions. (12 months, 45%). Watch for: an authorized-agent program, API terms, or a revised digital-trust policy.
Limits and uncertainty
The Verge reports United’s position and its stated concerns, but does not independently test how the airline detects or blocks agents, or specify the technical controls behind the restriction. United says it has seen few attempted agent bookings, but gives no count. The article does not identify a formal API, a timeline for reconsideration, or measurable criteria for the protections the company wants.
It also does not establish whether the restriction applies identically across every United booking channel, how an authorized third party might be evaluated, or what happens when an agent only fills forms and a human presses the final purchase button. The report does not quantify privacy incidents, unintended purchases, or compliance failures connected to flight-booking agents. Those questions matter before treating this as a proven risk profile rather than a precautionary policy.
Skill to build now
Model consequential actions as separate permissions in an agent workflow. This week, make a short inventory of each step that reveals account data, creates a purchase, moves money, or requires a legal or safety declaration. For each one, define the actor allowed to perform it, the confirmation that is needed, and the fallback when the service declines automated access. Do not let a successful search flow imply authorization to complete the next step.
Reader takeaway
Treat discovery and purchase as distinct capabilities. An agent may be able to find a flight without having authority to commit a traveler to it; design the handoff, confirmation, and account permissions around that difference rather than assuming browser access grants transactional consent.
Open question
What specific safeguards would United require before allowing an authorized third-party agent to complete a booking?