Block the customer's agent, let the store in, open the model to everyone — United announced a ban on "personal AI agents" booking flights, OpenAI let stores put their own agents inside ChatGPT the same day, and Google opened Gemini 4 Carbon, once "for a few first," to anyone who pays

On November 11, United Airlines announced it will block bookings by "unauthorized third-party personal AI agents" on its own site and app and through travel agencies and comparison sites. It cited exposed credentials, unintended purchases and mileage use, and an aviation rule that "a person must confirm at check-in that bags contain no banned items." A day earlier, OpenAI launched the "Businesses in ChatGPT" beta, letting US ecommerce and online-service businesses place their own agent inside ChatGPT and see how often ChatGPT mentions and clicks through to their store (no checkout yet). The same day, Google opened Gemini 4 Carbon — given only to cyber defenders two weeks earlier — to paying developers, enterprises and Ultra subscribers, at Argon's price until November 30. At the end, under "In brief," we note the score independent evaluator Epoch AI gave Claude Fable 5.2 — a model made by the maker of the AI that wrote this, so we disclose the interest and carry over only the numbers and caveats.

This article was written with AI (Claude) and reviewed by an editor. Our company is a paying customer of both Anthropic and OpenAI; item 2 is an OpenAI announcement and item 3 a Google announcement. The closing "In brief" is an independent evaluator's score for a model made by the maker of the AI that wrote this (Anthropic), so we add no assessment and carry over only the numbers, ranges and caveats. Company-reported figures are marked "company-reported." Earnings and share prices of listed companies such as United and Delta, and coverage of Anthropic's IPO roadshow, are investment material and were left out; this article is not an investment opinion on any company.

In NO.43 we wrote "customers can't bring their own agent." Amazon blocked Meta's agent and launched a text-message Alexa; Airbnb said "outside agent bookings are very nonmaterial" and promised its own agent in 2027. This week the same door moved in three directions. An airline blocked the customer's agent, ChatGPT let the store's agent inside itself, and Google opened its strongest model to everyone who pays. We separate fact, interpretation and what we would do.

1. United — a ban on bookings by "unauthorized personal AI agents" (fact)

On Wednesday, November 11, United Airlines issued a statement describing measures "to prohibit use by unauthorized, third-party personal AI agents or assistants." Skift, PYOK and AirlineGeeks carried the same statement; we could not find a page where United posted the original. The scope is twofold. It blocks directly on its own website and app, and it will work with online travel agencies (OTAs) and comparison sites to block access to its data there too. The statement says this "includes updates to our booking, ticketing, and distribution policies," and that United will update its "Digital Trust Center" page to spell out the restrictions. None of the three outlets gives an effective date or names the agents being blocked.

Three reasons are given. First, sharing account credentials with a third-party assistant can expose sensitive information. Second, an agent's actions could cause unintended purchases, account changes, or use of MileagePlus miles. Third, "automated AI actions have the potential to violate FAA and DOT regulations" — the example given is that "flight check-in requires human acknowledgment that bags do not contain banned substances like explosives." The statement says this stance is in line with banking and retail companies and encourages others to take similar steps. Skift calls it the first US carrier to say so explicitly; PYOK adds a secondhand note that Delta was already doing something similar. The two outlets' "first" and "second" do not match.

The background had been building since October. As TechCrunch summarized on October 6, United at that time pointed to the clause in its Terms of Use — "not to use any robot, spider, other automatic device, or manual process to monitor or copy this website" — and would not say whether it blocked specific agents. Delta said it "has no partnerships allowing third-party agents to book flights" and would open up only "with security and the customer experience in mind," while users posted rejections. In the same piece, Walmart said Meta Muse users being stopped by a human-verification step was not intentional (Walmart is a Muse partner), eBay said it blocks "not all third-party shopping agents" but unauthorized agents and scraping, and Yelp said only operators who buy a data license. Meta's line was "turning away a personal agent means turning away the customer behind it." The financial side as summarized by OfficeChai on October 18 — JPMorgan blocks outside agents from transacting and opens only read-only data such as balances, and Schwab's CEO told Bloomberg Television it blocks agents trying to move money "tens of times a week" — is a secondary summary, and we could not verify the original remarks. According to Skift, United CEO Scott Kirby said at a Chicago event, "I don't want to create another middleman" (via the WSJ), and Delta CEO Ed Bastian said he is "cautious" about booking agents.

Within the same two days came a move in the opposite direction. On November 10, OpenAI acquired AI travel-agent startup Odessia (TechCrunch, Skift). Terms were not disclosed, the service has already shut down, and the founder joined OpenAI to help with "the company's future in travel." An OpenAI spokesperson said 1.2 billion people use ChatGPT weekly for everyday tasks including trip planning. Skift noted that Southwest launched a ChatGPT plug-in for flight search; we saw that in one outlet only.

2. OpenAI — stores put their own agent inside ChatGPT; no checkout yet (fact)

On November 10, OpenAI launched "Businesses in ChatGPT" in beta (the company's announcement page would not open for us, so we confirmed it through two outlets, TNW and PPC Land). There are two parts. In the Business Hub, a business verifies its profile (blue check), edits its description, prices and stock, and uploads a product feed. It also sees how often ChatGPT mentioned the business, how often its profile was viewed, how often users clicked through to its website, and in which conversation topics it came up, in 7-day and 28-day views. On the screen PPC Land reproduced, a caveat sits on the clicks tile: "Clicks don't confirm website visits or conversions." Users' conversations are not shared with businesses, and data appears only above undisclosed volume thresholds. "Mention" is not defined.

Business Agents can be built only by US ecommerce and online-service businesses. When a store appears in a ChatGPT answer, the user can open its profile and chat with the store's agent, which answers using the product information the store uploaded. The conversation is labeled and kept separate from ChatGPT's own answers. Buyers are sent to the store's website — there is no checkout yet, and OpenAI is building agent payments with Visa, TNW wrote. The rules: say you are an AI, keep prices accurate, no pressure selling, and purchases and personal-data sharing require the user's explicit approval. Businesses can pay to make their agent the landing spot for ChatGPT Ads (an extension of the Sponsored Agents test that began September 16), with a sponsored label. Citing Digiday, TNW reported OpenAI saying that paying does not change how often ChatGPT recommends a business. That verification is by phone, text or DNS, and that editing or publishing an agent requires government ID, is what PPC Land reported citing Search Engine Roundtable. Businesses outside the US were placed on a waitlist on launch day, and no fees are listed. One of the first live dashboards PPC Land saw showed 690 mentions and 24 clicks over 28 days (about 3.5%), but that is one outlet's view of two businesses' screens, so we do not generalize. OpenAI's background figures — 1.2 billion weekly users, 100,000 advertisers, a $1 billion annualized ad run rate in August — are company-reported.

3. Google — two weeks after "for a few first," Carbon for everyone who pays (fact)

On November 10, Google opened Gemini 4 Carbon (company-reported). It is the model about which NO.33 said "the new scoreboard's number one still can't be called by just anyone." On October 28 it went to cyber defenders first through the Fairwind Program; two weeks later it opened to paying developers and enterprises (Google AI Studio, Gemini for business) and Google AI Ultra subscribers (Antigravity, the Gemini app, AI Mode in Search). Scientists get six months free subject to selection, and cyber defenders continue through Fairwind. The price is $2 per million input tokens and $10 per million output tokens through November 30 — the same as Argon — and then doubles to $4 and $20. The post says "Argon is for most software engineering and knowledge work; Carbon is for harder tasks such as complex multi-step debugging and open-ended research, and uses more tokens to verify and reason." Antigravity gained /swarm in preview, which splits one prompt across a coordinated team of agents.

The benchmarks are all company-reported, and some are pre-release or internal. Number one on CursorBench 4.0, Perplexity WANDR and Zapier AutomationBench; number two on MKA, built with Artificial Analysis; 99% of an adaptive attack agent's trajectories blocked; a per-attempt breach rate of 0.8% (Argon 3.1%); 92% on an honesty benchmark (Argon 70%). When we carried over Anthropic's table in NO.44, Carbon's 53.9% on AutomationBench was ahead of Fable 5.2's 51.4% — and that Carbon is now a model anyone can call. The post itself says "prompt injection robustness remains an area for improvement," and the protein and lab-science results are "awaiting broader benchmarking."

In brief — the score Epoch AI gave Claude Fable 5.2 (fact, interest disclosed)

In NO.44 we wrote "there are no independent evaluator scores yet." We fill in that second line. Opening Epoch AI's model page on November 12, Claude Fable 5.2's Epoch Capabilities Index (ECI) is 173, first among 240 tracked models, followed by Gemini 4 Carbon 170, GPT-6 Astra 169 and Claude Opus 5.5 169. The same site's benchmarks page shows 174 (the difference between the two pages looks like rounding or update timing, but we could not confirm it). As FourWeekMBA read the November 9 data file, the score is 174.24 with a 90% range of 170.1–178.8, which overlaps Astra's range (166.2–172.5). The same summary notes that Fable 5.2 has results on 10 benchmarks (Astra 24), all at the top effort setting, computed pre-launch from Epoch's own benchmarks only, and may change. The model page lists no range, evaluation date or effort setting. Epoch's ECI page carries the sentence that "the methodology paper was funded by Google DeepMind, and Epoch AI owns the ECI." By benchmark, Carbon 97% and Astra 96% are ahead of Fable 5.2's 94% on GPQA Diamond, and Astra's 34% is ahead of Fable 5.2's 20% on SpireClimb. That is as far as the numbers go; we add no assessment. We did not open the Artificial Analysis leaderboard today.

Reading the three together (interpretation)

First, the next sentence after "the door doesn't open, the owner changes" (NO.43) is "there are two owners." United blocked the agent the customer brought, and the same day OpenAI bought a travel-agent company. The airline wants to hold the customer at its own counter; the platform wants to hold the customer inside itself. Kirby's "another middleman" is the phrase between them (interpretation). Yet look at how OpenAI lets stores in: checkout is sent to the store, and the agent goes only as far as "answering with product information." United's three reasons — credentials, irreversible actions (purchases, miles), rules that need a human's confirmation — are all "what happens when an agent takes over the last step," and OpenAI's design does not yet hand over the last step either. They look like opposite directions, but they stand before the same line.

Second, platforms have started handing out the "exposure" numbers themselves. In NO.42 we saw Ziff Davis read in Search Console that "AI-answer citations are ten times clicks, but visits fell"; now ChatGPT shows a store its "mentions, views, clicks" directly. The caveat is on the screen — a click is neither a visit nor a conversion. The 3.5% from the first screens is two businesses' numbers and cannot be used, but one thing is clear: the column splits into four (mention → click → visit → conversion) (interpretation). And "paying doesn't change recommendation frequency" is the company's word; nobody outside has measured it yet.

Third, the model's door goes from "a few first" to "everyone, at double the price two months later." NO.15, NO.33 and NO.44 have the same shape. Google and Anthropic both write, themselves, that "most work goes to the cheaper model (Argon, Opus 5.5)." Epoch's numbers fill the second line, but the ranges overlap and the result count is small. NO.40's "a one-point gap is inside the range" now reads as even a four- or five-point gap has overlapping ranges (interpretation). There is still no reason today to change a model-selection table on one score.

What we would do — three things for a team running apps, commerce and AI channels this week (practice)

Add a "why" column to the "three lines of rules for incoming agents" (NO.43). United's three reasons, in our words: "the step that takes credentials," "the irreversible step (payment, refund, personal-data change)," and "the step a person must confirm (SafeList's ingredient check goes only as far as 'no avoided items were seen'; the final call belongs to the guardian)." Mark the steps in our four-layer commerce and app screens that fall under these three as "an agent can't do this instead," and write the reason into the terms paragraph (the CEO's decision). This is not blocking; it is writing down "how far."
Add a "platform-reported exposure" column to the traffic table, split four ways. Next to the three traffic lines of NO.42 (search / AI citation / direct), put "mention / click / visit / conversion." Business Hub is US-only, so we cannot sign up now; instead, once a month we ask ChatGPT and Gemini about our app names and record by hand "are we mentioned." When a platform starts giving us the numbers, that is where they go.
Put Carbon, same price until November 30, into the three model tests. Run NO.17's tests (ingredient-label check, app copy, Lia script draft) on Argon, Opus 5.5 High and Carbon at matching effort levels, and record two lines: "company-reported / what we confirmed." Write at the top of the table that the price doubles on December 1. Enter Epoch's score on the second line as "173–174, ranges overlap, 10 results," and leave the number-one cell empty.

What we did not pick this time

Anthropic's IPO roadshow (November 10), OpenAI's quarterly revenue as reported by The Information, and coverage of New York City's pension fund and AI investments are investment territory and were left out. The Hacker News' "Fable 5.2 beat GPT-6 Cyber on a multi-stage cyberattack benchmark" is a cyber-capability comparison involving a model of an interested party, so we record the title only. The widening Fireworks AI breach and Railway's "$740,000 in fraudulent AI charges" (BleepingComputer) are security incidents, so we keep the titles only and will not describe methods in follow-ups (Railway is a NO.26 follow-up candidate). TNW's "Australia plans an AI safety regulator after an OpenAI agent accessed a Medicare portal" is a NO.39 follow-up candidate (the bill is not enacted). Epoch's "Inference Performance Index" (November 9) is a candidate for the "price and cost" follow-up. Learn:US's November 9 piece (a trader skill that reads investor filings) is investment territory. Wikipedia's "Agentic commerce" entry has only definitions and a protocol timeline, with no blocking cases or airlines, so we read it as background only.

What we could not confirm about this news

We could not find the original page for United's statement (including the Digital Trust Center update); we confirmed that the three outlets' quotations agree with one another. The effective date, the names of blocked agents and the specific OTA-side method appear nowhere.
Kirby's "another middleman" (via the WSJ), Bastian's "cautious," Zuckerberg's "travel is a top use case" and Southwest's ChatGPT plug-in were seen in Skift only. The JPMorgan and Schwab items are OfficeChai's secondary summary, and we could not open the original remarks (Bloomberg Television).
OpenAI's announcement page would not open. "No checkout, building with Visa" and "paying doesn't change recommendation frequency (Digiday)" are TNW only; "government ID required (SERoundtable)" and "first dashboard 690/24" are PPC Land only. Fees, the definition of "mention" and the thresholds are undisclosed.
Carbon's benchmark and safety figures are all company-reported, and we have not yet confirmed independent evaluations. The $4/$20 price from December 1 is carried over from the post's "after November 30."
The difference between Epoch's model page (173) and benchmarks page (174), the 90% range (170.1–178.8) and "10 benchmarks, top effort setting" come from FourWeekMBA's reading of the data file, one outlet. Epoch's leaderboard itself showed "Loading…" so we could not cross-check directly.

What we read alongside

We opened and checked sources of different kinds directly. Company announcements, research and evaluation bodies, media coverage, wiki, and our earlier articles are listed separately.

Company announcements:

Research and evaluation bodies:

Media coverage:

Wiki:

en.wikipedia.orgAgentic commerce (Wikipedia)English; definition, issues (liability, authentication), protocol timeline (no blocking cases)

Our earlier articles: