United Airlines announced Wednesday it would restrict third-party artificial intelligence bots from accessing its digital platforms, citing risks of credential exposure, unintended purchases, and unauthorized account activity — a move that reflects growing corporate caution around agentic AI systems.
The airline's decision echoes a similar step taken by Amazon, which recently blocked Meta's Muse agent from completing purchases on its site, underscoring an emerging pattern of major platforms drawing boundaries around what autonomous AI systems can do on behalf of users.
The restrictions come as AI agents grow more capable of acting on users' behalf across a widening range of tasks — booking travel, managing investments, handling prescription refill requests, and making retail purchases. OpenAI's agent offering, Dot, can book flights, hotels, and excursions when connected to a payment method. Robinhood allows AI agents to execute trades. Meta's Muse can arrange rideshares based on weather forecasts.
But the breadth of those capabilities is precisely the concern, according to Shomit Ghose, adjunct professor at the University of San Francisco School of Management and a lecturer at the University of California, Berkeley College of Engineering.
"You can have agents do interesting things for you, like categorize your spending, or flag unusual charges, or model what-if scenarios," Ghose said. "Those are good things, but bad things would be moving money, making trades, filing forms. All those things should stay manual at this point."
Ghose argues that users should avoid delegating autonomous control to agents "anytime health, wealth, or privacy are involved." The concern, he said, is that current AI agents operate in a highly literal way, lacking the contextual inference that humans apply by instinct, education, and cultural knowledge.
If a user instructs a bot to book the cheapest available flight, the agent may return a 3 a.m. departure with multiple layovers — technically satisfying the command, but missing the user's actual intent. Similarly, an agent tasked with finding a "good barbecue restaurant" might book a table at a place that markets itself as "the best barbecue in the world" without accounting for poor reviews elsewhere or an inconvenient location.
"The bot only knows your context," Ghose said. "It cannot infer, as we humans are able to do, because of instinct and culture and education."
The financial stakes of that gap can be real. In Booking Holdings' third-quarter earnings report, the Connecticut-based travel technology company found that customers who used AI assistants to book accommodations on its Agoda platform spent 20% more than those who did not. The company did not attribute the difference to a single cause, leaving open whether the agents recommended pricier options or whether users who opted in simply sought more expensive amenities.
For investment decisions, the risk calculus is sharper still. Shridhar Rathore, an experienced investor who uses agentic trading tools, said agents can simplify the trading process but should not be trusted to execute independently.
"Agents can make your trading experience easier, there is no doubt about it," Rathore said. "But making investment decisions, that's where people can lose money if they are not careful — they have to make sure that for the execution, the human is in the loop."
Ghose recommends that users grant agents access only through "limited permission accounts" — allowing a bot to access a news subscription, for example, rather than a bank account or credit card.
The healthcare sector presents perhaps the most acute version of these risks. While federal agencies are backing programs that would allow AI agents to assist with diagnostics and prescription management, Ghose warned that agents operating on incomplete medical records "won't be able to recognize a dangerous interaction or a worsening condition before the action has already taken effect."
As agentic AI becomes embedded across industries, the question of when to keep humans in the decision loop is fast becoming a practical and regulatory flashpoint — one that United Airlines, Amazon, and a growing list of platform operators appear increasingly unwilling to leave to users alone.
Disclaimer