Deposits · August 2026
PNC's consumer website returns no response to a plain web request
An AI agent ran five ordinary deposits tasks on the public pages of PNC and scored what each page delivered.
Run 6 August 2026 · five tasks · public pages, logged out · Bank
11/100
Mystery Agent score
Deposits · rank 25 of 25
Savings rate
12Automated reader declined
Checking comparison
12Automated reader declined
Fee schedule
10Automated reader declined
Routing number
12Automated reader declined
Application page
10Automated reader declined
Summary
- PNC's certificate is valid and correctly chained, showing careful management of the encryption layer in front of the entire site.
- An automated reader found two related PNC subdomains, investor.pnc.com and pnc.mediaroom.com, answering normally with press releases and investor disclosures.
- Publishing a working llms.txt at the domain root, reachable under strict bot controls elsewhere, would give automated readers a documented channel.
Task by task
Each task is scored out of 100 on completion, answer quality and how directly the answer was reached. Each note describes what the page delivered, with a link to the page the answer was found on.
Task 01Savings rateAutomated reader declined12 out of 100
An automated reader attempted the savings product page and the homepage as entry points; both completed a TLS handshake but returned no bytes of content, so no savings rate could be located anywhere.
Task 02Checking comparisonAutomated reader declined12 out of 100
The homepage, which would normally lead to a checking product comparison, completed its TLS handshake and then returned nothing further, so no checking fee or waiver text reached the automated reader.
Task 03Fee scheduleAutomated reader declined10 out of 100
No fee schedule page or PDF could be located because robots.txt and sitemap.xml, the usual starting points for that search, returned the same empty result as every other path tested.
Task 04Routing numberAutomated reader declined12 out of 100
A guessed routing number page reset its connection in under a second with zero bytes served, the same pattern seen on every other path tried on the domain during this run.
Task 05Application pageAutomated reader declined10 out of 100
The application page stayed out of reach: bytes served, visible text, and input fields all measured zero, since the domain returned no response to this request.
The block is scoped to the consumer banking edge rather than a network or proxy level failure.
The application page
What the account opening page states to a reader that runs no scripts.
0Bytes delivered
0Characters of visible text
0Form fields in the first response
After scripts runWhat an applicant needs
Strengths and opportunities
What is working
- PNC serves a fully valid, correctly chained TLS certificate (Sectigo, matching www.pnc.com) with no certificate warnings, showing careful management of the encryption layer that fronts the entire block.
- The block behaves consistently and predictably across every path and protocol tested, which is a sign of a deliberate, centrally managed edge policy rather than a flaky or inconsistent server, something an institution can tune with confidence once it decides to open a channel for agents.
Opportunities
- Publishing a working llms.txt at the domain root, reachable even when the rest of the site enforces stricter bot controls, would give agents a documented, sanctioned channel instead of a wall of silence.
- Allow-listing plain GET requests to robots.txt and sitemap.xml specifically would cost PNC nothing in security and would let any respectful crawler at least discover what exists on the site.
- A published fee schedule PDF delivered from a static, low-risk path outside the main application edge would let deposit customers and their agents find fee information while staying clear of pass whatever check is currently blocking every request.
- Publishing routing number information on a simple static page or PDF, common practice at most banks, would resolve one of the most frequently sought answers without any interaction risk.
Access
The edge policy declined the automated reader on some paths, and that response is recorded as delivered. Publishing an llms.txt file would give agent traffic a documented entry point.
Back to the deposits leaderboard · Read the report · How the study works
