They really can’t. As long as you run Claude/Codex desktop or plugin, it will control your web browser session indistinguishable from your own user actions.

Unless there is some Claude AI safety concern of booking tickets.