I've also been hitting this issue for several weeks now; the privacy pass extension has been completely unusable in that time.
The problem is reproducible both on and off VPN, and irrespective of DNS configuration (I've checked against multiple public resolvers).
I've confirmed it also occurs when using a fresh Firefox profile with no other extensions installed.
Kagi Privacy Pass version: 1.0.12
Browser: Firefox 152.0.4
OS: archlinux
Request headers:
GET /search?q=test HTTP/3
Host: kagi.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
X-Kagi-PrivacyPass-Client: true
Authorization: PrivateToken token="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
TE: trailers
Response headers:
HTTP/3 200
www-authenticate: PrivateToken challenge=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX, token-key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
vary: origin, access-control-request-method, access-control-request-headers
access-control-allow-origin: *
access-control-expose-headers: www-authenticate
x-cloud-trace-context: 05803df7bdedcd9029693cee072fae89
date: Fri, 10 Jul 2026 19:48:20 GMT
content-type: text/html
server: Google Frontend
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000
Just as @dO9G8 highlights above, the main query response payload is always empty but the favicon is returned without issue.