Muah AI (muah.ai) is an AI girlfriend site whose user data leaked in 2024. Have I Been Pwned lists 1,910,261 Muah accounts exposed in a breach dated 17 September 2024, with email addresses tied to the AI prompts users had typed. 404 Media broke the story on 8 October 2024 and reported that the data included prompts seeking child sexual abuse material.
This page reports that breach as news, then sets out what Muah’s own terms, privacy policy and price list said in October 2026. We do not recommend Muah, we have not used or paid for it, and nothing on this page pays us. On 3 November 2026 muah.ai served our logged-out browser a waiting-line page (“Your current position in line is: 917”) instead of the site, so the Muah pages quoted below are Internet Archive copies from October 2026, each linked in the sources.
What leaked in the Muah AI breach
Have I Been Pwned (HIBP), the breach index run by security researcher Troy Hunt, added Muah on 8 October 2024. Its entry names three kinds of exposed data: “AI prompts”, “Email addresses” and “Sexual fetishes”. It describes 1.9M email addresses “alongside prompts to generate AI-based images” and says many prompts also described child exploitation scenarios. Passwords are not on the list.
HIBP marks the Muah breach as sensitive. That means nobody can look up a stranger’s address in it: the owner of an email address has to sign in to the HIBP dashboard to see whether it is included.
404 Media reporter Joseph Cox wrote that a hacker handed over the database and that the prompts sat next to email addresses, many of them personal accounts showing users’ real names. The hacker told 404 Media the site was “a handful of open-source projects duct-taped together.” Law firm Linklaters wrote on 14 October 2024 that some of the addresses appear not to be burner accounts and can identify the person behind them.
The reporting, in order:
- 17 Sep 2024: the breach occurs, by HIBP’s date.
- 8 Oct 2024: 404 Media publishes the first report, and HIBP adds 1,910,261 accounts flagged as sensitive.
- 9 Oct 2024: Malwarebytes and CyberInsider carry the administrator’s response.
- 11 Oct 2024: Malwarebytes reports the data in use for extortion.
- 14 Oct 2024: Linklaters warns of attackers contacting IT staff, and Troy Hunt backs a California bill on AI-generated abuse material.
Some sites call this an “October 2024 breach”. October is when it became public. HIBP dates the breach itself to 17 September 2024.
What Muah’s operators said
Muah’s administrator said the hack had been noticed about a week earlier and claimed it was sponsored by competitors in the “uncensored AI industry”, Malwarebytes reported on 9 October 2024. CyberInsider names the administrator as Harvard Han. None of the reports we read offered evidence for the competitor claim.
The administrator also said that moderation staff suspend and delete child-related chatbots in Muah’s character gallery, Discord and Reddit. Malwarebytes reported one case in which a moderator told users to take that kind of discussion to direct messages instead. Muah’s stated position on use, in the administrator’s words: “AI technology should be for everyone, and its use case to be decided by each mature, individual adult.”
In October 2026 Muah’s archived homepage carried a banner reading “NOT ALLOWED: Any child prompt = SUSPENSION!!!” HIBP’s entry links no breach notice from Muah, and we found none on the homepage, terms or privacy policy we read.
Extortion and legal risk for people in the data
Malwarebytes updated its story on 11 October 2024 to say the leaked data was being used in active extortion attempts. Linklaters wrote on 14 October 2024 that threat actors had contacted IT employees, seeking access to their employers’ systems, and compared the case to the 2015 Ashley Madison breach.
Linklaters also set out the UK position. Making or possessing child sexual abuse material is a crime under section 1 of the Protection of Children Act 1978, and computer-generated images are covered separately by section 62 of the Coroners and Justice Act 2009. Troy Hunt wrote in his 14 October 2024 weekly update that he expected the law to catch up with AI-generated material and, of a California bill on it: “The bill can’t pass soon enough.”
If an extortion email cites your Muah account, keep the message and report it to the police rather than paying.
Muah’s privacy policy is still dated 2022
Muah’s privacy policy shows “Effective Date: 5-17-2022” in the capture of 15 October 2026. That is more than two years before the breach, and the text does not mention it. The terms of service carry the same 17 May 2022 date.
The policy says Muah collects your name, email, phone number “and any other information you voluntarily provide”, plus IP address, device data and activity logs. It never mentions chats, prompts, generated images or voice, and it gives no retention period for any of them. On security it says only: “We employ reasonable security measures” and “we cannot guarantee the absolute security of your information.”
To delete your data, the policy tells you to email love@muah.ai; it lists rights to “access, update, correct, or delete” personal information. The archived homepage code also includes a “Delete account” button for signed-in users. Neither says how long deleted data stays on Muah’s servers. The terms add a licence for Muah to “use, reproduce, modify, distribute, and display” content you submit “for the purpose of providing and promoting the Service.”
Age checks on Muah AI: a typed 18+ statement
Muah’s terms say “you must be of 18 years or older to use our service.” The archived homepage sign-in box says “You must be at least eighteen years old to join” and offers a demo with no login, plus sign-in through Google, email, phone, Discord, Apple or Microsoft. We saw no ID check or date-of-birth step on the logged-out pages. The privacy policy says Muah “will suspend all user accounts proven to be under the age of 18.”
Muah AI prices, refunds and apps in October 2026
Muah’s live pay page redirected to a login screen when we checked on 30 October 2026. The last archived copy, from 12 October 2026, listed three VIP tiers. Annual totals are our arithmetic from the per-month figures.
| Tier | Monthly billing | Annual billing, per month | Annual total (ours) |
|---|---|---|---|
| VIP Access | $19.99 | $5.83 | $69.96 |
| GPT 5/UHD VIP | $49.99 | $41.50 | $498.00 |
| ULTRA VIP | $99.99 | $83.20 | $998.40 |
The VIP tier now carries the line “Buy VIP only if you want to support the project.” The UHD tier says its GPT 5/Grok model handles the “First 30 chats per day”. ULTRA says the first 100. Payment options were card and crypto.
Refunds got stricter. The pay page of 24 October 2025 said “Refundable within 30 days.” The October 2026 copy drops that line, and the terms say: “Consumer subscription purchases under Muah AI are NOT refundable.” Support can still grant an exception refund at its discretion.
Muah’s homepage still linked an iPhone app and a Google Play app in October 2026, plus a direct APK download. On 3 November 2026 Apple’s lookup for the app’s ID returned no result in the US store, and the Google Play listing returned a 404 page.
What other Muah AI pages leave out
The Muah page ranking around #7 in the US for “muah ai review” (aichatcompanions.com, updated 20 September 2026) gives the breach one sentence. It does not give the account count, the dates, the data types, the reporting on child sexual abuse prompts or Muah’s response, and it lists no prices.
If you have a Muah account
- Check your email in the Have I Been Pwned dashboard (the breach is hidden from public search).
- Change any password you also used on Muah.
- Email love@muah.ai to request deletion of your data, citing the policy’s “delete” right, and keep the reply.
- Cancel any subscription in Muah’s settings, by email or with your payment provider, the three routes the terms list. Do not expect a refund.
For how other companion apps handle chats, retention and deletion, read our AI girlfriend app privacy guide.