Some scanners simply search for the injected string ("found" in this case) somewhere on the page, if "found" is in the search results, then it would classify it as a positive finding.

If the XSS string is being interpreted as a string in the search function (literally searching for the string "alert('Found')", then you can chalk it up as a false positive - the scanner saw it's own injected string in the resulting page.

Some scanners simply search for the injected string ("found" in this case) somewhere on the page, if "found" is in the search results, then it would classify it as a positive finding.

If the XSS string is being interpreted as a string in the search function (literally searching for the string <script>alert('Found')</script>, then you can chalk it up as a false positive - the scanner saw its own injected string in the resulting page.