What the restriction covers
United announced restrictions on unauthorized third-party personal AI agents on November 11, 2026. The policy covers direct access to its digital platforms and indirect access through travel agencies and aggregators, with updates to booking, ticketing and distribution policies.
United’s definition reaches a third-party AI agent, bot, browser extension or browser feature that searches, books, buys, manages or collects information on united.com or the United app for a customer without United’s permission. Its FAQ separately says assistive technology for customers with disabilities is unaffected. That exception is part of the published scope.
Permission from the traveler and permission from United are different under this policy. The FAQ says that giving an assistant access does not mean United will let it transact with the airline. It specifically warns against sharing confirmation numbers, MileagePlus details or information the traveler would not want the tool to remember or another person or system to access.
Travel agencies and booking platforms are covered on both direct and indirect channels. United says they cannot use third-party AI agents to search for, book or manage United travel for customers; agencies may use their own third-party AI tools only with United’s permission. The published condition is airline permission, rather than a general assurance that booking through an intermediary avoids the restriction.
The current FAQ answers “not yet” when asked whether United works with any third-party AI agents, and says that page will be updated if this changes. United describes its goal as standardized, secure integrations with privacy, security, authorization and accountability protections. The announcement says the airline will continue evaluating how personal assistants interact with its services; neither page supplies a complete rollout timetable or approval procedure for a particular tool.
Earlier bookings and human check-in
Agent bookings made before November 11, 2026 will not be canceled, according to United’s FAQ. United still recommends reviewing recent travel plans to make sure they were booked and ticketed correctly. That is the stated treatment of those earlier bookings; the answer does not promise the same treatment for later unauthorized-agent bookings or specify a new refund entitlement.
Automatic check-in is a specific concern in both official pages. United says an unauthorized AI agent could cause a traveler to miss important safety content, and warns that automated actions have the potential to violate FAA and DOT requirements. Its example is the human acknowledgment during check-in that bags contain no prohibited substances such as explosives. This is the airline’s stated rationale; it does not identify a particular regulation or announce that every use of AI violates aviation law.
United’s announcement points customers to its own app for booking, seat selection and flight rescheduling, including during bad weather. Its research FAQ says that when an AI tool generates speech or text, customers should review the output and carry out the search themselves on united.com or in the United app. These are the direct customer actions described by the airline, rather than permission for an unauthorized tool to operate the account.
Using AI for general trip research
AI research and inspiration remain possible within the FAQ’s stated limits: use general information, keep sensitive or private data out of the tool, and do not have it access united.com or the United app. The page mentions AI tools built by United as well as other research tools. Consult the [official third-party AI policy](https://www.united.com/en/us/fly/help-center/digital-trust-center/artificial-intelligence/third-party-ai-agents.html) for the airline’s current definition and answers.
United illustrates general planning questions with a Caribbean trip in January that avoids crowds, things to do in New York in May, and a list of the top ten restaurants in Rome. These are examples of research requests; the page does not provide a verified restaurant ranking, crowd forecast or flight-availability result for them.
The contrasting examples involve account and identity details: sharing MileagePlus numbers, passwords or sign-in information; requesting a first-class upgrade with the example confirmation code ABC847; and asking a tool to call Alan at the illustrative number 123-456-8910. United also names a person’s name, birthdate and address as details used to validate identity. These are the page’s examples of information to avoid supplying, not contact instructions for getting airline assistance.
MileagePlus control and warning signs
United explains the policy through the control an agent can receive: access to a MileagePlus account, trip booking, add-on purchases and upgrades. The airline says such delegation can expose personal information or produce bookings, account changes and mileage use without the customer’s approval. It also identifies personal details, travel plans and preferences as information entrusted to it, used for regulatory requirements and personalized services.
If login details were already shared with a third-party agent, United recommends changing the MileagePlus password immediately. The page gives the same immediate-password advice for suspected unauthorized AI-agent access and directs customers to its account-help steps. If a tool made an unintended purchase or used miles, the FAQ says to secure the account immediately; it supplies no automatic reversal, reimbursement or mileage-restoration guarantee.
United’s linked [account-recovery guide](https://www.united.com/en/us/fly/mileageplus/service-center/account-help/hacked.html) explains that unauthorized sign-ins may leave a member locked out or with changed account details. Its warning signs include unexpected password or settings changes, missing emails, flight alerts or status messages, and mileage or credit-card purchases the member did not make. The guide urges prompt action after losing access.
Steps for a suspected account takeover
For a suspected takeover, United first tells the member to secure the account by changing the password and making sure one-time passcodes reach a verified phone or email. It then tells the member to review purchases, personal information and linked accounts for suspicious activity. These recovery steps are separate from checking that an earlier AI-made flight reservation was ticketed correctly.
Report the suspected problem to United Customer Care and describe it as an account takeover. The guide also says to monitor card and bank statements, explaining that exposed personal data may let attackers access accounts on other websites. This is the source’s response guidance, not a finding that a particular traveler’s other accounts have been compromised.
For immediate account help, United lists its MileagePlus Service Center at 1-800-421-4655. The recovery page also links to its [MileagePlus contact directory](https://www.united.com/en/us/fly/mileageplus/contact-info.html) for additional numbers or chat. Use the published account-assistance route when an unintended account action needs investigation; the policy FAQ itself does not set a response deadline, refund amount or account-recovery completion time.
United’s existing account-protection guidance
United’s prevention list says not to share a MileagePlus number, username or password, and to sign in only through united.com or its app. It advises watching for suspicious emails and texts, contacting the airline when a message’s authenticity is uncertain, using a strong different password for each account, and maintaining a verified phone or email to receive a new one-time passcode at sign-in.
The same guide recommends regularly checking account activity and login history, keeping devices updated, installing antivirus software and avoiding public Wi-Fi where possible. These are existing account-protection steps in the linked guidance; the November announcement does not present them as new ticket conditions or a promise that following them eliminates every security risk.