A traveler asks an AI assistant to find a flight, compare the options, and buy the best ticket. One airline says third-party agents should stay out of its booking system. Another has put flight shopping inside ChatGPT, while still sending customers to its own website to pay.

Those choices look like opposite reactions to AI. The real difference is how much of the journey each airline lets an assistant handle and who gets to approve the final step.

That distinction matters more than the headline word "ban." It points to a design question every company with customer accounts will face: should an AI act through a customer's existing login, or should it use a limited, approved connection built for the task?

What United is restricting

On November 11, 2026, United said it was taking steps to restrict unauthorized, third-party personal AI agents from its digital platforms. The airline said this work would cover direct access and access through travel agencies and aggregators, and would include policy changes covering booking and ticket distribution. (United's announcement)

United's stated concerns are concrete. Giving a personal assistant account credentials could expose sensitive data. An agent could make an unintended purchase, change account details, or use MileagePlus miles. The airline also raised a check-in example: passengers must acknowledge that their bags do not contain prohibited items such as explosives. (United)

The policy is broader than "don't let a bot click Buy." United's statement describes third-party assistants as a risk across multiple steps in managing a trip. The company did not publish a technical implementation plan in that announcement, so claims about exactly how it will detect or block agents would be speculation.

The check-in example also shows why a human confirmation screen is not a complete answer to every problem. A person may need to make a specific declaration. An agent cannot truthfully make that declaration on the traveler's behalf just because the traveler asked it to finish check-in. The interface has to return that decision to the person.

What Southwest is opening up

Southwest announced a ChatGPT plugin on October 6, 2026. Its own description calls it the first step in a phased AI-powered booking approach, and says travelers can discover destinations and shop for Southwest flights in ChatGPT. (Southwest's announcement)

But the first phase is not the same as an autonomous agent completing a purchase. Travel Weekly reported that ChatGPT users are handed off to Southwest.com to make the purchase and confirm it. It also reported that the plugin can deliver flight information directly from Southwest's systems during search. (Travel Weekly's report)

So the current comparison is not "United blocks AI, Southwest lets AI buy tickets." The verified picture is narrower:

  • United: restricts unauthorized third-party agents from using its systems for travel actions.
  • Southwest: lets customers discover and shop for flights through a named ChatGPT integration, then sends them to the airline's site for the purchase and confirmation.

One model controls the boundary by limiting outside agents. The other creates a controlled doorway for a specific partner and keeps checkout on the airline's own platform. Neither announcement establishes that an unrestricted AI assistant can complete a ticket transaction independently on either airline.

This comparison is a product-boundary choice

It is tempting to read United's move as anti-AI and Southwest's as pro-AI. Its systems can expose identity and loyalty data alongside transaction details and safety declarations.

Credentials create a large permission surface. If an assistant signs in as the traveler, the airline may have difficulty distinguishing a permitted search from an unexpected account change. A password or session cookie can grant more access than the user intended for a single task. That is a general security concern, and it matches the account-exposure risk United specifically named. (United)

A partner integration can narrow the job. Southwest's announcement describes a named plugin and a phased approach. Travel Weekly says purchases still happen on Southwest.com. That gives the airline a defined point to present fare rules, collect payment, and ask the customer to confirm. This is not proof that every risk disappears. It is a more limited transaction path than handing an agent broad account access.

The business incentive is real on both sides. A flight search that begins inside a general AI assistant may direct customers toward an airline earlier in their planning. Southwest says its plugin is intended to make a more direct path from inspiration and discovery to booking options. United argues that unauthorized access can harm customer security and safety. Each company is drawing a boundary around its own distribution channel and customer relationship. These are the companies' stated positions, not independent proof that either strategy will win.

The distinction resembles the difference between a customer-authorized capability and a customer's full set of credentials. A good integration can expose just enough data and actions for one task. A general-purpose agent logged into an account may inherit permissions for many other tasks, whether or not it needs them.

Where the human should re-enter the flow

A useful way to judge an AI booking product is to split the journey into stages instead of asking whether "AI can book flights."

  • Explore: Suggest destinations and explain options. This is low impact if the assistant is clear that results may be incomplete.
  • Search: Query current schedules and fares from an airline's system. Accuracy matters because stale information wastes time and can mislead a traveler.
  • Compare: Explain the fare tradeoffs and disclose restrictions. The assistant should distinguish retrieved facts from its own summary.
  • Prepare: Fill passenger details or assemble a proposed itinerary. The traveler should be able to review every field before it is submitted.
  • Purchase or change: Present the final itinerary, total cost, passenger names, fare conditions, and consequences of changes. The traveler should explicitly confirm the exact transaction.
  • Make a regulated declaration: Return the decision to the traveler when the airline requires a personal acknowledgment, such as the check-in declaration United cited.

This is a decision checklist, not a claim that any particular airline currently implements each step. It helps expose where a product moves from assistance into authority.

The most important confirmation is not a generic "Continue?" button. The traveler should be able to review all material transaction details before submission. If the agent changes any of those details after approval, the approval should no longer apply.

For customer-facing systems, that last point deserves emphasis. Approval should attach to a specific transaction, not grant the assistant an open-ended license to act later. A person who approved a $300 ticket for Tuesday did not necessarily approve a $600 ticket for Wednesday or a cancellation to search for alternatives.

What this comparison does not prove

Both announcements are early signals, not settled industry standards. United said it was taking steps and would continue evaluating how personal assistants interact with its services. Southwest described its ChatGPT plugin as the first phase of a broader approach. The details may change as products and policies evolve. (United; Southwest)

The evidence also does not show that a dedicated integration is automatically safe, or that every personal AI agent is careless. It shows different control models and the risks each airline chose to emphasize. More evidence would be needed to compare error rates, customer outcomes, or security performance.

A company can block unauthorized automation and still build its own AI features. It can also permit a narrow integration without handing a model unrestricted access to customer accounts. That middle ground may be where useful agent products develop: access to current data, a small set of allowed actions, and a clear handoff before the system commits the customer to something costly or hard to reverse.

A practical test for AI transactions

Before trusting an AI assistant with a purchase or account change, ask:

  • Does it use a named, authorized integration, or does it need my password?
  • Can it see only the data needed for this task?
  • Does it show current source data, or only a generated summary?
  • Can I review the exact item, passenger, price, and conditions before submission?
  • Does approval apply to one specific action, or can the agent keep acting afterward?
  • Are declarations or consent statements returned to me when they require my judgment?
  • Can I find the transaction record and reverse or dispute an unintended action?

If the product cannot answer these questions, let it help with research, but keep the final purchase and account changes in the official service.

I write practical analysis about AI and software. Subscribe for future articles if you want more.

Would you trust an AI assistant to choose and buy a flight, or would you want it to stop at a review screen? What would the assistant need to show before you approved the purchase?

Sources