So this is why United airlines and all the other folks should open up an API or MCP server for agents. When you do that, you make it easy for the agent to do the right thing, and go through a known access point which you can control and rate limit.

The user also has more fine grained permission over the interaction. They could choose to give permissions just to read account details or flight info or to actually make a purchase. United knows it's an agent acting.

Of course, unbehaved agents will still go around, but by providing a golden path, the better behaved ones will be better citizens.

The alternative is, as parent comment suggests, a user can allow Claude to drive their browser. Then, apart from heuristics, United Airlines can't really tell the difference between Claude driving the browser and a user driving the browser. Therefore you have less granular permissions and more unbounded actions and risk. There is no way to audit what is done by a human being versus by an agent. And United Airlines still has agents interacting with their site.