Verification
Is Muah.AI safe?
No. This is the only app on this site we tell you not to use, and it is not a close call. In September 2024 Muah.AI lost 1.9 million email addresses along with the prompts those accounts had written — a combination Have I Been Pwned classifies as too sensitive to be publicly searchable. Two years on, the company still discloses no legal entity.
1. The breach
CONFIRMED Breach date: September 2024. Added to HIBP: 8 October 2024. Accounts: 1,900,000.
Compromised data classes, verbatim from the record: AI prompts, email addresses, sexual fetishes.
HIBP's own description: "In September 2024, the 'AI girlfriend' website Muah.AI suffered a data breach. The breach exposed 1.9M email addresses alongside prompts to generate AI-based images. Many of the prompts were highly sexual in nature, with many also describing child exploitation scenarios."
That last clause is not our characterisation. It is the text Have I Been Pwned publishes on its own breach page, and it is corroborated by 404 Media's reporting of 8 October 2024, which broke the story. We state it because it is the single most important fact about what this platform was moderating, and leaving it out would misrepresent the record.
HIBP flags this breach as sensitive. That means you cannot type your email into the site and check whether you were in it. You have to verify ownership of the address through their notification system first.
HIBP applies that flag when merely appearing in a breach could damage someone. The everyday breach — a retailer losing your address and order history — is publicly searchable. This one is not, because the data class is what you wrote to a chatbot in private.
2. How it happened
The person who took the data told 404 Media they had not set out to breach anything. In their words, they visited the site, noticed "it looked like it was put together pretty poorly," and described the architecture as "a handful of open-source projects duct-taped together." Finding a vulnerability that reached the database was, on their account, trivial.
Malwarebytes reported that by 11 October 2024 — three days after disclosure — people whose addresses were in the data were receiving extortion attempts.
NOT ESTABLISHED It was never established whether those threats rested on what the senders had actually read, or simply on the fact that an address appeared in a leak from an app of this kind. For the person receiving the email, the distinction is academic.
3. What the operator said
Per Malwarebytes' account, Muah.AI's operator said the breach had happened around a week before disclosure and suggested competitors in the uncensored AI market had sponsored the attack. The company also stated it employed moderation staff to remove child-related content.
DISPUTED That last claim was contradicted by the leaked material itself, which reportedly showed moderators directing users discussing underage characters to continue privately rather than removing them. We are reporting a dispute, not adjudicating it — but a company's own data contradicting its own safety claim is the reason a review site exists.
4. Who would you even complain to?
CONFIRMED We checked muah.ai on 31 August 2026. The site describes itself as "California Based" and nothing more. No company name. No registration number. No registered address.
Compare the same question at other apps we cover: Candy.ai publishes EverAI Limited, Malta, registration C107181, with a street address. Nomi ships through the app stores as AI Glimpse Inc, verified by Apple. Character.AI is a named Delaware corporation.
This matters more here than anywhere else on this site. An app that has already lost this category of data, and that names no one you could write to, offers you no recourse if it happens again. There is no regulator with obvious jurisdiction, no company to serve, and no published person to hold responsible.
The comparison that makes the point: Janitor AI also names no legal entity, and we flag that as its single worst characteristic. Janitor AI has not lost 1.9 million accounts.
5. What has changed since
CONFIRMED The homepage now carries the line "Any child prompt = SUSPENSION!!!" alongside its "Uncensored, Zero Censorship" positioning. That warning was added after the breach. It is a real change and we note it.
NOT FOUND What we could not find, anywhere on the site: a security page, a breach notice, a post-incident report, a named data protection contact, or any statement of what was fixed. The site still describes itself as "BETA-Website."
A banner is not remediation. Two years after losing the most sensitive data class in this category, the public record shows no published account of what went wrong or what was rebuilt.
So, is it safe?
No, and this is the one page on this site where we give a flat answer. Everywhere else we split the question — the company might be real while the refund terms are bad, or the security unproven while the billing is fine. Here every part of the answer points the same way.
| Question | Muah.AI |
|---|---|
| Is there a real company? | No entity disclosed |
| Confirmed breach? | Yes — 1.9M accounts, Sept 2024 |
| What leaked? | Emails, prompts, stated fetishes |
| Public remediation? | None found |
| Recourse if it recurs? | Nobody to complain to |
If you already have an account: the address you used is in a two-year-old leak that circulated widely. Assume it is public. If you reused that password anywhere, change it there first — the password, not the app, is the thing that can still cost you something. If the address is one you use elsewhere, be alert to extortion email; the standard advice applies, which is that paying confirms the address is live.
The general rule this app exists to illustrate: a dedicated email address, a unique password, and nothing identifying in conversation. Those three habits are what turn a breach like this from a personal crisis into an inconvenience. The full privacy record for every app we cover is here.
Affiliate link · we are paid if you subscribe
If you came here looking for an uncensored companion app and want one from a company that at least exists on paper: Candy.ai publishes EverAI Limited, Malta, registration C107181 with a street address, and has no breach on record. It is $47.88 a year. Read our safety assessment of it first — its refund terms are genuinely bad, and we say so.
Go to Candy.ai →We earn $36 if you subscribe through this link. We earn nothing from Muah.AI and never have, which is why the verdict above cost us nothing to write. A named company with published registration is a low bar. It is still a bar Muah.AI does not clear.
Sources
- Breach date, date added, account count, compromised data classes, sensitive classification and descriptive text — Have I Been Pwned breach record, checked 31 August 2026: haveibeenpwned.com/Breach/Muah
- Original reporting, hacker's account of the vulnerability and the "duct-taped together" quote — 404 Media, 8 October 2024: 404media.co
- Extortion reports of 11 October 2024, operator's response and the moderation dispute — Malwarebytes Labs, October 2024: malwarebytes.com
- Absence of a disclosed legal entity, the "California Based" description, the "Any child prompt = SUSPENSION!!!" notice and the "BETA-Website" label — muah.ai homepage, checked 31 August 2026: muah.ai
- Comparison corporate details — candy.ai terms of service (EverAI Limited, Malta, C107181); Nomi seller identity from its Apple App Store listing.