United to block customers from using AI agents, citing cyber threats

United Airlines will block AI agents from managing customers’ reservations and flight purchases, warning of significant cybersecurity and privacy risks, as well as potential legal violations.

Other large corporations have made similar announcements recently, including Bank of America, which cautioned users last week to never share user IDs and passwords with agents.

Many companies, particularly banks and airlines, have faced mounting difficulty as they try to separate human customers from their AI assistants. The firms warn that consumers’ credentials are at risk of leaking when they entrust agents with their logins and passwords.

“Sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles,” United said in a Wednesday press release.

Automated AI actions also could break Federal Aviation Administration and Department of Transportation rules, the release said, citing the fact that flight check-in requires “human acknowledgment that bags do not contain banned substances like explosives.”

The airline is implementing the new access restrictions both within its own digital platforms and separately through aggregators and agencies.  

“This work includes updates to our booking, ticketing and distribution policies,” the press release said.

But United and other corporate giants’ moves are not a long-term cure all, according to Raj Ananthanpillai, founder and CEO of identity verification company Trua.

“Blocking agents or forcing more data sharing just delays the inevitable,” he said via text, arguing for wider use of verified identity tokens.