Quick Answer
- Is it a scam? Not in the sense of taking money for nothing. It's a working platform.
- Has it been hacked? Yes. A breach dated September 17, 2024 is recorded by Have I Been Pwned.
- What leaked? About 1.9 million email addresses, AI prompts and sexual fetish information.
- Is the data searchable? Only by the verified owner of an email address, because it's flagged sensitive.
- Has it been independently audited since? We found no evidence of one.
- Safer options: Clonella for encryption, Selira AI for no card at all, Darlink AI for Swiss operation.
What Happened in the Muah AI Breach?
According to Have I Been Pwned (HIBP), a breach index run by security researcher Troy Hunt, the "AI girlfriend" site Muah.AI was breached in September 2024, with the incident dated September 17. It added the breach to its index on October 8, 2024, listing 1,910,261 exposed accounts.
HIBP lists three kinds of exposed data: email addresses, AI prompts and sexual fetishes. The prompts were the text users typed to describe images they wanted. Troy Hunt noted that 24% of the email addresses were already in HIBP, so at least some 460,000 had been used on other sites.
404 Media broke the story and reported that many prompts were sexual in nature and that some described child sexual exploitation. We won't repeat any of that material. The point for readers is that the data tied explicit requests to email addresses, many of them personal accounts or work addresses with real names attached.
Why Was It Flagged as Sensitive?
HIBP marks a breach "sensitive" when being listed could harm someone if others could look them up. A sensitive breach can only be searched by the verified owner of an email address, who receives a confirmation link. That's why you can check yourself but nobody can search someone else.
Legal analysts have noted that people whose emails were tied to certain prompts could face extortion risks and, in some cases, criminal exposure. That's a risk specific to this kind of breach: the data was far more personal than a typical leaked password list.
Who Said What About the Cause?
The hacker told 404 Media that the site looked poorly built and described it as a handful of open-source projects stuck together, with flaws found quickly. A Muah administrator told 404 Media that the attack was organised by competitors in the uncensored AI industry. We couldn't verify either claim.
Has Muah AI Improved Its Security Since?
We found no independent audit, no published encryption statement and no clear account of what changed. Some third-party reviews describe other problems, such as app-store and community removals, but they're from low-authority sources, so we haven't relied on them. Absence of evidence isn't proof the site is unsafe today, but it's the reason we wouldn't trust it with anything sensitive.
What Should You Do If You Used Muah AI?
1. Check your email on Have I Been Pwned. For a sensitive breach, you'll need to verify the address through its confirmation email. 2. Change any password you reused on other accounts. 3. Be alert for extortion messages. If someone threatens to expose you, don't pay, keep the evidence and report it to local law enforcement. In the US you can report to the FBI's Internet Crime Complaint Center. 4. Use a separate email for any adult platform in future.
Is Muah AI Safe to Use Now?
For privacy, we wouldn't recommend it. For payment safety, we found no reports of stolen funds. See Muah AI alternatives and our Muah AI review for the features and what it costs.
Which Safer Alternatives Exist?
End-to-end encryption and a written no-training-on-chats policy
Free with no credit card, so there's no payment record
Operated from Switzerland, with deep memory on its top tier
Published Estonian corporate registration and discreet billing
States that no adult transaction appears on your bank statement
FAQs
Is Muah AI safe?
Not for privacy. It suffered a confirmed breach in September 2024 that exposed 1.9 million email addresses and the prompts users had typed, and we found no independent audit since.
Was Muah AI hacked?
Yes. Have I Been Pwned records a breach dated September 17, 2024, added on October 8, 2024, with 1,910,261 accounts.
What data leaked in the Muah AI breach?
Email addresses, AI prompts and sexual fetish information, according to Have I Been Pwned.
How do I check if I was in the Muah AI breach?
Search your email on Have I Been Pwned. Because the breach is flagged sensitive, you must verify ownership of the address through a confirmation email.
Is Muah AI a scam?
It's a working platform, not a scam in that sense, but its security record is poor.
What are safer alternatives to Muah AI?
Clonella, Selira AI and Darlink AI are better placed on privacy. See Muah AI alternatives.
Sources and Methodology
The breach details come from Have I Been Pwned's entry for Muah.AI (breach dated September 17, 2024, added October 8, 2024, 1,910,261 accounts), Troy Hunt's notes of October 8 to 12, 2024 on the breach and the share already in HIBP, and 404 Media's report of October 8, 2024, as summarised by Cybernews and others. The hacker's and administrator's statements are as reported by 404 Media and haven't been verified. We haven't tested Muah AI ourselves. We omit the content of leaked prompts deliberately.
This page contains affiliate links for the alternatives and we earn commission at no cost to you; commission doesn't change scores.
