Extract API fabricates a nonexistent incident entry on a status page (reproducible?)

Kagi's Extract API, called through the `kagi_extract` MCP tool on `https://contabo-status.com/`, returned a fabricated security-incident entry that appears nowhere in the page's raw HTML, its RSS feed, or any other independent fetch of the same URL, according to a reproducible bug report. The fabricated entry, identical across 3 separate calls, claims a "26.10.2026 01:30 pm (UTC+1) Security Incident – Investigating" involving unauthorized access to systems hosting VDS and advises rotating SSH keys, passwords, and API tokens. The reporter asks Kagi to investigate whether Extract's content-cleaning pipeline includes an LLM post-processing step rather than the documented deterministic HTML-to-Markdown conversion, since the failure mode resembles LLM hallucination rather than a parsing bug.

Calling the Extract API via the kagi extract MCP tool on https://contabo-status.com/ consistently returns a fabricated incident entry that does not exist in the page's raw HTML, its RSS feed, or any other independent fetch of the same URL. Fabricated entry returned by Extract verbatim, identical across 3 separate calls : 26.10.2026 01:30 pm UTC+1 Security Incident – Investigating We detected unauthorized access to systems hosting VDS. Affected systems are isolated and under investigation. Affected customers will be notified directly by email. As a precaution, we recommend rotating SSH keys, passwords, and API tokens used on your VDS. We only communicate via this page - Next update: 15:00 CET Please investigate whether Extract's content-cleaning pipeline includes an LLM post-processing step as opposed to deterministic HTML→Markdown conversion as documented , since the failure mode looks like classic LLM hallucination rather than a parsing bug.