Four Hotel Groups Let AI Agents Reach Checkout in Every Test Run

Four of the nine largest hotel groups — Marriott, IHG, Accor and Choice — took an AI agent all the way to checkout in three consecutive test runs, while Hyatt blocked it every time with an HTTP 429 challenge. That is the headline finding of Part Two of Pertlink's investigation into whether hotels are shutting out AI agents, published after a reader challenged the evidence behind Part One of 18 October.

Part Two, built on research by Claude for Pertlink, re-ran all ten live routes on 19 October between 07:40 and 07:58 Manila time, from the same home connection in the Philippines. At every stop point the tester recorded a screenshot, the HTTP status code from the browser's timing record, the bot-management scripts on the page, and the form fields present. No personal or payment details were entered. No reservation was submitted.

The verdict is narrower than Part One's. There is no evidence of deliberate closure. There is also no proof the industry is open.

What did the re-tests find?

The results split the nine groups both AI tools tested into three camps.

• Open every run: Marriott, IHG, Accor, Choice. All returned HTTP 200 at checkout pages, with room holds and card fields visible — Marriott at a total of US$771.18, Choice at US$324.40, Hilton at US$521.02.
• Changed between runs: Hilton (a ChatGPT 502 error that did not recur), Hyatt (blocked for Claude, open for ChatGPT), Wyndham (connection dropped on 18 October; 71 New York hotels returned the next day).
• Gated: Jin Jiang requires a mobile-number and SMS-code login despite showing rates of ¥845–¥996. H World hands booking off to an app-download page with no booking form.

Best Western, tested by Claude only, reached a booking summary on both days, US$484.30 total, with hCaptcha loaded but never triggered. BTG Homeinns, tested by ChatGPT only, showed rooms but required login to book.

Who actually decides access?

Here is the sharpest finding: no readable robots.txt file from any group names an AI agent in order to block it. Access is being decided by bot-management configuration, not published policy.

Hyatt's block came from Kasada's challenge software — HTTP 429 on the search page, the homepage and even robots.txt, on both days. Yet Choice runs the same Kasada script alongside Akamai's and let both agents through every time. The vendor alone does not decide the outcome; its settings do.

The published rules point the other way entirely. Of seven readable robots.txt files, Marriott, Hilton, IHG, Accor and Wyndham disallow search or booking pages for all automated visitors — rules the agents passed in practice. Choice explicitly allows seven AI agents, including ChatGPT-User, Claude-User and PerplexityBot. Best Western allows four, among them GPTBot and ClaudeBot. Jin Jiang and H World have no robots.txt file at all (a 404 response).

A separate study by Nicolas Sitter, covering 105,002 hotel websites across seven countries, found only 3.3% set any robots.txt rule against AI crawlers. Pertlink now labels that as context only — a broader population, mostly individual hotels, not the groups tested here.

What changed from Part One?

Two results reversed overnight, which is itself the story.

Wyndham, which dropped Claude's availability search mid-connection on 18 October straight after Akamai's sensor exchange, returned 71 New York hotels a day later with rates in Singapore from SGD 240. On ChatGPT's own disputed routes, Claude's re-run differed in all three cases: it reached Hilton Singapore Orchard's payment page at S$539.55 where ChatGPT had hit a 502, and it was blocked at Andaz Singapore where ChatGPT had reached payment. The differences follow the agent and the day, not the property.

The report is candid about its limits, which deserves note. ChatGPT's results are text-only. Gemini's paper describes no method and conflicts with the live tests in places. Two agents over two days cannot settle a question where bot scoring appears to vary by agent, network, location and time. The authors concede they cannot see inside these systems, and a temporary fault or a real inventory gap could explain individual results.

No hotel group reviewed the report before publication. Pertlink has offered a right of reply and will append any responses.

Why should operators care?

The commercial stakes are straightforward. If AI agents can complete a search-to-checkout path, they can book — and the direct-booking channel regains relevance against online travel agencies. If bot filters block them silently, with no policy decision behind it, groups may be turning away a distribution channel without ever choosing to.

Pertlink's advice to operators is blunt: test your own sites with more than one agent, from more than one location, and repeat over time. As the report puts it: "The intelligence may be artificial. But the experience is human."

Expect these findings to shift again — which is rather the point.