4 hotel groups let an AI agent open checkout in all 3 tests

On 19 October 2026, a new test sent Claude, an AI tool, to the sites of 9 large hotel groups. In 4 groups, the agent opened checkout in all 3 tests, and 2 more groups keep booking behind a login or an app. Checkout is the page for guest data or payment, and the test made no booking.

How the test worked

Claude used the same browser, home network, hotels and stay in each test. At each stop it kept a screenshot, the page status code, the bot scripts and the form fields. It put in no data about persons and no payment data.

The results

• Marriott and IHG: checkout opened in all tests.
• Accor and Choice: checkout opened in all tests.
• Jin Jiang and H World: login with a mobile number or an app.

Wyndham did not let Claude in on the first day, but it opened the guest data page a day after.

Hyatt stopped the agent with challenge software, and Choice uses the same software and let each agent in.

What is not known

The tests used a small number of agents and days. The author cannot see in the systems, and a fault can cause one result.

Insight: Hotel sites let agents in by default, not by choice

Yelp and Delta stop agents by decision, and 2 banks give security as the cause. These hotel tests find no rule with the name of an agent to stop. The tests point to bot software settings, not hotel strategy, as the gate, and this reads as a gate that the software vendor holds. If your business has a website with booking, a setting that you did not select can be your policy.