Marriott, IHG, Accor and Choice Let AI Agents Reach Checkout

Marriott, IHG, Accor and Choice let AI agents reach the checkout page in two independent live tests on 18 October 2026. The tests — one run with Anthropic's Claude, one with OpenAI's ChatGPT — covered eleven of the world's largest hotel groups, and the results were consolidated in research by Pertlink. Four more groups split or stalled: Hyatt, Hilton, Wyndham and the Chinese majors gated booking behind logins and apps.

The study was a response to The Verge's 17 October 2026 report by Emma Roth, "Websites are closing their doors to AI agents," which described Delta stopping agents from booking tickets and Yelp admitting only paying agents. Hotels had already appeared in the frame: Skift reported on 2 October that Meta's Muse agent failed at the room-and-rate step on Hilton, Marriott and Hyatt sites, while Instinct completed searches on all three. Hilton told Skift it accepts bookings from AI agents and has not blocked Muse.

What did the live tests find?

Seven of eleven groups let at least one agent reach checkout; four did so in both tests. No booking was submitted and no payment details entered — the stop point was the first page asking for guest or payment information.

• Open in both tests: Marriott, IHG, Accor, Choice. Best Western passed Claude's single test.
• Split results: Hyatt stopped Claude with a Kasada bot challenge from a home connection in the Philippines, while ChatGPT's cloud browser reached the payment page at Andaz Singapore. Hilton took Claude to payment at Tempo Times Square but returned a "502 Bad Gateway" error to ChatGPT at Hilton Singapore Orchard.
• No rates shown: Wyndham dropped Claude's availability request right after Akamai's bot-detection sensor reported in; ChatGPT's Singapore property showed no availability.
• Gated by design: Jin Jiang, BTG Homeinns and H World put booking behind SMS logins, member accounts or app handoffs — channel design, not an anti-agent policy.

The takeaway: the same website can open for one agent and close for another on the same day, depending on network, location and route.

Why did Gemini disagree?

Google's Gemini reported that every group blocked reservations, naming a security vendor for each. Its paper gives no test method, dates or properties, and both live tests contradicted it — both agents reached Choice's payment page, which Gemini lists as blocked. The researchers treat Gemini's table as hypothesis, not evidence. That's a caution for hotel teams using AI for research: check conclusions against direct observation.

Who is actually setting policy?

Claude's review of robots.txt and llms.txt files found that no group whose files it could read named AI agents to block. Choice and Best Western explicitly welcome named AI agents; IHG, Accor, Wyndham and Choice publish llms.txt guides. A wider study of 105,002 hotel websites across seven countries found only 3.3% set any robots.txt rule against AI crawlers. Formal policy rarely blocks AI — bot-management layers do it by default.

Those defenses exist for a reason. Imperva's 2024 Bad Bot Report, as reported by Travel Weekly, put malicious bots at 44.5% of online travel traffic, with travel absorbing 20.7% of all bot attacks. The problem is that a guest's agent can behave much like a scraper.

What plumbing is arriving?

Wyndham's chief executive says the group has placed its own agents inside ChatGPT, Claude and Gemini; its ChatGPT app hands guests to wyndhamhotels.com to finish booking. Cloudflare's "signed agents", announced in August 2025, let platforms cryptographically sign agent requests. Google's Agent Payments Protocol, launched in September 2025, uses signed mandates with user approval for the final purchase. None of the tests observed these standards in use on hotel group websites.

The researchers flag two blind spots for operators. A refused agent goes elsewhere — likely to intermediaries — though no test measured guest behavior or revenue. And when an availability search returns nothing, the agent cannot tell "sold out" from "blocked", so it reports no rooms and the guest looks elsewhere. Next step for any group: test your own sites with several agents from several locations, then check whether your robots.txt and llms.txt describe what your systems actually do.