On November 11, United Airlines quietly rewrote its Contract of Carriage. Buried in the update was a rule that will shape the next two years of agentic AI: personal AI agents may no longer book, modify, or service United tickets. Not on united.com. Not through the app. Not through a travel agency, and not through an aggregator.
Two days later, OpenAI launched ChatGPT Wallet, built so its assistants can shop and pay on a user's behalf. Put the two announcements side by side and you have the story of the agent economy in 2026. One company shipped a checkout. Another welded its checkout shut.
The pitch for two years has been that AI agents would route around gatekeepers. This week the gatekeepers answered, and they did not sound impressed.
The Security Case Is Real. So Is the Motive.
United's stated reasoning is not stupid, and pretending otherwise would be cheap. Handing MileagePlus credentials to a third-party assistant is a genuine attack surface. As the airline put it: "sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles."
There is a regulatory argument too. Automated check-in collides with the moment a human must affirm their bag holds no prohibited items, a requirement United ties to FAA and DOT rules. An agent clicking through that screen skips a safety acknowledgment.
The scope is the interesting part. United defines an AI agent as software taking autonomous or semi-autonomous action, even when a person supervises or approves it. That reaches assistants inside social, messaging, and search platforms, AI browsers, standalone agents, and agents arriving through agencies or aggregators. Customer permission, United makes clear, is not airline permission.
Then come the remedies, which read like a list of things an airline can do to a loyalty account:
- Cancel reservations made, modified, or serviced by an AI agent without notice
- Void tickets and cancel the remaining segments of an itinerary
- Delete MileagePlus miles, revoke elite status, and terminate program membership
- Pursue legal action against whoever stands behind the agent
Fine. Security policies are allowed to have teeth. But the website terms shift the frame. Automated access now requires prior written permission, and fare, schedule, availability, and pricing data may not be used to train, fine-tune, ground, or evaluate any AI model. That clause is not about a passenger's password. It is about keeping a dataset out of someone else's training corpus.
The exemptions are just as revealing. Assistive technology stays. Ordinary browsers operated by a person stay, as long as their agent features stay off. Tools that turn your voice into a search you run yourself stay. Reading is fine. Acting is not.
The Real Fight Is Over the Last Click
Henry Harteveldt of Atmosphere Research Group gave CBS News the least romantic explanation available. United, he said, does not want to add "yet another, and potentially even more powerful, intermediary" on top of Google search, price-comparison sites, and online travel agencies. Flight searches cost airlines money. Bot-driven searches cost them more.
CEO Scott Kirby reportedly told a Chicago audience a day before the policy landed that he was reluctant to put another intermediary between the airline and its customers. The timing is not subtle. Neither is the commercial logic. Airlines have spent decades building direct channels, loyalty programs, and upsell funnels. An agent that compares offers on the passenger's criteria, ignores the upsell, and picks the cheapest acceptable seat is a machine for dismantling that funnel.
United is not the odd one out for being nervous, only for saying so out loud. Delta was reported last month to be blocking similar tools. Southwest went the other way, making inventory visible to ChatGPT users. Rivals, in Reuters-syndicated coverage, say customers should decide and assume the risk. Letting the customer assume the risk is a lovely phrase for an industry that would rather not be accountable for anything.
The demand side is thinner than the hype suggests. Expedia Group research from April 2026 found strong interest in AI-assisted trip planning and far less appetite for handing over the actual purchase. People like the research. They do not like the debit. Vendors call that a formatting problem. It is a trust problem.
Across the same week, the pattern stops being about aviation:
- JPMorgan moved to stop AI agents from using customer credit cards
- OpenAI shipped ChatGPT Wallet two days after United's ban
- United says it does not work with any third-party AI agent today
- PCWorld's headline captured the mood: agents have a big problem, nobody wants to let them in
The build layer is accelerating. The transaction layer is sealing shut.
The escape hatch is the instructive part. United says it wants standardized integrations with privacy, security, authorization, and accountability controls before agents touch accounts. Translation: agents get in, but through a door United controls, under terms United writes, with a partner United approves and a contract it can renegotiate.
That is not agentic commerce. It is a B2B API agreement with a chatbot for a front end. Authorization and liability are genuinely unsolved, so it may be the right engineering answer. It is simply not the future the demos promised, where your assistant negotiates because it knows what you want.
For travelers, the practical change is small. United fares remain bookable through Kayak, Hopper, and Google Flights, and bookings made before November 11 stand. Harteveldt's summary holds: fares will not get harder to find, and United has not made them any easier either.
For everyone building agents, the lesson is less flattering. Agents are cheap to demo and expensive to authorize. The bottleneck in late 2026 is not reasoning quality, tool calling, or context length. It is permission, and permission belongs to whoever owns the transaction.
United looked at the agentic future and decided it would rather own the last click. Nineteen months of launches could not change that. One contract revision did.
Comments