cd /news/ai-tools/extract-api-fabricates-a-nonexistent… · home › topics › ai-tools › article
[ARTICLE · art-158274] src=kagifeedback.org ↗ pub= topic=ai-tools verified=true sentiment=↓ negative

Extract API fabricates a nonexistent incident entry on a status page (reproducible?)

Kagi's Extract API, called through the `kagi_extract` MCP tool on `https://contabo-status.com/`, returned a fabricated security-incident entry that appears nowhere in the page's raw HTML, its RSS feed, or any other independent fetch of the same URL, according to a reproducible bug report. The fabricated entry, identical across 3 separate calls, claims a "26.10.2026 01:30 pm (UTC+1) Security Incident – Investigating" involving unauthorized access to systems hosting VDS and advises rotating SSH keys, passwords, and API tokens. The reporter asks Kagi to investigate whether Extract's content-cleaning pipeline includes an LLM post-processing step rather than the documented deterministic HTML-to-Markdown conversion, since the failure mode resembles LLM hallucination rather than a parsing bug.

by read1 min views2 publishedOct 26, 2026

Calling the Extract API (via the kagi_extract MCP tool) on https://contabo-status.com/ consistently returns a fabricated incident entry that does not exist in the page's raw HTML, its RSS feed, or any other independent fetch of the same URL.

Fabricated entry returned by Extract (verbatim, identical across 3 separate calls):

26.10.2026 01:30 pm (UTC+1) Security Incident – Investigating

We detected unauthorized access to systems hosting VDS. Affected systems are

isolated and under investigation.

Affected customers will be notified directly by email. As a precaution, we

recommend rotating SSH keys, passwords, and API tokens used on your VDS.

We only communicate via this page - Next update: 15:00 CET Please investigate whether Extract's content-cleaning pipeline includes an LLM post-processing step (as opposed to deterministic HTML→Markdown conversion as documented), since the failure mode looks like classic LLM hallucination rather than a parsing bug.

── more in #ai-tools 4 stories · sorted by recency
── more on @kagi 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/extract-api-fabricat…] indexed:0 read:1min 2026-10-26 · —