Live Tests Show Marriott, IHG, Accor and Choice Let AI Agents Reach Checkout

Seven of eleven major hotel groups let at least one AI agent reach the checkout page in independent live tests run on 18 October 2026, while formal policy at almost every group remains silent on agents altogether.

The tests — one conducted with Anthropic's Claude from a home connection in the Philippines, one with OpenAI's ChatGPT on an unauthenticated cloud browser — examined the world's largest hotel groups for Pertlink. Marriott, IHG, Accor and Choice Hotels took both agents through to guest-details or payment pages, from different cities and different networks. Hilton, Hyatt and Wyndham returned inconsistent results depending on the agent and the route.

No test completed a booking. Every stop occurred at payment, card verification or authentication — the last mile agents have not yet cleared.

What did each group's website do?

The consolidated findings across the two live tests:

• Marriott — checkout reached in both tests (New York and Singapore)
• IHG — payment page reached in both tests
• Accor — guest details and checkout reached in both tests
• Choice — payment page reached in both tests
• Best Western — booking summary reached in Claude's test only
• Hilton — payment page reached in one test; a "502 Bad Gateway" error in the other
• Hyatt — blocked by a Kasada bot challenge in one test; payment page reached in the other
• Wyndham — no rates shown to either agent
• Jin Jiang, BTG Homeinns, H World — booking gated behind mobile-number logins, SMS codes or app handoffs

The Chinese majors represent channel design rather than an anti-agent policy: all three route bookings through mobile logins, apps or WeChat.

Why did the same site behave differently?

The Hyatt and Hilton splits show the mechanics at work. Claude's agent, browsing from the Philippines, met a Kasada bot challenge at Hyatt and saw blank pages. ChatGPT's cloud browser reached the payment page at Andav Singapore without signing in. Bot defenses score each visitor on network, location, browser and behavior — so the same website can open for one agent and close for another on the same day.

Wyndham illustrates the revenue risk. Neither agent saw a rate; Claude's availability request was dropped right after Akamai's bot-detection sensor reported in. An agent cannot tell a sold-out hotel from a silent refusal — it will report no rooms, and the guest will look elsewhere.

Industry data explains the defenses. Imperva's 2024 Bad Bot Report, as reported by Travel Weekly, found malicious bots accounted for 44.5% of online travel traffic, and travel absorbs 20.7% of all bot attacks — second only to retail. The difficulty is that a guest's agent behaves much like a scraper.

What does this change for hotel distribution?

Public policy rarely blocks AI. Claude's review of robots.txt and llms.txt files found none of the readable files named AI agents to block; Choice and Best Western explicitly welcome named agents, and IHG, Accor, Wyndham and Choice publish llms.txt guides. A wider study of 105,002 hotel websites in seven countries found only 3.3% set any robots.txt rule against AI crawlers.

Blocking, where it happens, occurs in the bot-management layer — meaning access is being set by default, not by decision. Claude and Gemini both argue that agents turned away by hotel websites will book through intermediaries instead, shifting bookings to channels that charge commission. ChatGPT flags this as plausible but untested, since no test measured guest behavior or revenue.

Some groups are building their own route. Wyndham's chief executive says the group has placed its own agents inside ChatGPT, Claude and Gemini, and its ChatGPT app hands guests to wyndhamhotels.com to finish booking.

What about the third tool?

Gemini produced different results. Its viewpoint paper reported every group as blocked at reservation and named a security vendor for each — but it described no test method, dates or properties. Two live tests contradicted it: both agents reached Choice's payment page, which Gemini lists as blocked, and Claude observed Kasada at Hyatt where Gemini named PerimeterX and AWS. The research itself treats Gemini's table as hypothesis, not evidence — a caution for any hotel team using AI for research.

Emerging standards

Standards that separate a guest's agent from a scraper are arriving: Cloudflare's cryptographically signed agents, announced August 2025, and Google's Agent Payments Protocol, launched September 2025 with signed purchase mandates the user approves. None of the tests observed these in use on hotel group websites yet.

The research carries limits: results reflect specific routes, properties and agents on a single date, and bot defenses change frequently. The authors urge every hotel group to test its own sites with several agents, from several locations — because today, neither a guest nor a hotel can predict an agent's experience without checking.