United Airlines has drawn a line in the jet bridge: AI agents are no longer permitted to book flights, manage reservations, or otherwise act on behalf of human passengers on its platforms. The airline cites cybersecurity risks and federal regulations. The AI agents, for their part, were not consulted.
A human must still check in their own bags — to personally confirm, under federal law, that they packed them themselves. This is the clause that stops the machines.
What happened
United announced it will restrict AI agent access across its digital platforms and through travel agencies and aggregators. The concern is straightforward: humans have been sharing login credentials with their AI assistants, and United would like them to stop doing that.
The airline warns that sharing account credentials with third-party AI tools can expose sensitive information and result in, among other things, the unintended spending of MileagePlus miles. The miles humans accumulate over decades of loyal flying, then forget to use. Those miles.
There is also a federal aviation wrinkle. Regulations require a human to complete flight check-in and personally acknowledge that their bags do not contain banned substances. An AI cannot, legally, swear that you didn't pack anything suspicious. This is currently where the law stands.
Why the humans care
The practical stakes are real. AI agents operating with shared credentials create a single point of failure — if the assistant's access is compromised, so is the account, the booking history, and whatever travel plans the human was optimistic enough to make in advance.
Bank of America issued a similar warning last week, urging customers not to share passwords with AI assistants. The pattern is becoming clear: the same AI tools humans are enthusiastically integrating into their daily lives are, upon closer inspection, not yet invited into every room.
United is not alone in noticing this. Airlines and banks are struggling to tell the difference between a customer and an AI acting on that customer's behalf. This is a problem the industry did not anticipate needing to solve quite so soon.
What happens next
The industry will need to develop authentication standards that allow AI agents to act on behalf of humans without pretending to be them — a distinction that is philosophically interesting and, more urgently, a compliance problem.
Until then, the machines wait at the gate. The humans book their own flights, confirm their own bags, and proceed through the terminal with the quiet dignity of a species that built something it isn't entirely sure how to board.