Muah AI: what the 2024 data breach means for you

Breach data from Have I Been Pwned · August 2026

In September 2024 this service lost 1.9 million email addresses along with the image prompts attached to them. That is the first thing anyone searching for it should know, and it is not what the marketing says.

  • 1.9M accounts exposed
  • Pricing not published
  • No affiliate link here

What Muah AI is

Muah AI is an AI companion platform: chat with a character, with image generation on top. That the Muah AI image generator is central is not our inference — the breach registry describes what leaked as prompts for creating AI images, which is the clearest evidence available. Searches for Muah AI image to video suggest a stills-to-video feature as well, though we could not confirm it. The service markets itself on being uncensored, and that is the whole of its positioning.

We could not read the official pages. The site returns HTTP 403 to automated requests, so pricing, terms and the company behind it could not be verified at source. That matters more here than it would elsewhere, and the next section explains why.

An Android app exists on Google Play under the name Muah AI: AI Girlfriend Chat. The App Store listing gave contradictory responses when we checked, so we are not claiming either that it is there or that it was removed.

The September 2024 breach

This is the part that should decide whether you sign up, and it is documented by a primary source rather than by us: Have I Been Pwned, the breach registry run by security researcher Troy Hunt.

WhatValue
Breach dateSeptember 2024
Added to the registry8 October 2024
Accounts affected1,900,000
Data exposedAI prompts, email addresses, sexual fetishes
ClassificationSensitive — public search restricted

Two details make this different from an ordinary leak.

  • It was not just a list of emails. The prompts came out attached to the addresses that wrote them. That turns a leak into an identification: what a person asked the service to generate is tied to who they are.
  • Have I Been Pwned flagged it as sensitive. That setting removes the breach from public search so that nobody can look up whether a given address appears in it. It is applied when belonging to a service is itself capable of harming someone.

The registry entry states plainly that among the exposed prompts, «many were highly sexual in nature, with many also describing child exploitation scenarios». We are quoting the source rather than characterising it ourselves, and it is the reason there is no affiliate link to this service anywhere on this page.

We could not find a public statement from the company about what happened afterwards: whether users were notified, whether storage practices changed. If one exists, it is not where a reader would look for it.

Is Muah AI safe now?

Any honest Muah AI review has to stop here and say: we cannot tell you, and neither can anyone else who has not audited it. What can be said is what is knowable.

  • The 2024 data is out and stays out. Nothing the company does now retrieves it. If you used the service before September 2024 with an address you still use, that pairing exists in someone else’s copy.
  • No public post-mortem. After an incident of this size, a security write-up is the normal thing to publish. We did not find one.
  • The site is closed to inspection. Blocking automated reads is a legitimate anti-scraping measure, but it also means terms, pricing and data policy cannot be checked from outside.

If you used it before: check your address at haveibeenpwned.com. Because this breach is flagged sensitive you will need the email verification route rather than plain search — that restriction exists to protect you, not to obstruct you. Then change any password reused elsewhere, and treat unexpected messages referencing the service as an extortion attempt rather than a real threat.

The general lesson costs nothing and applies everywhere in this category: use an address that is not tied to your name, and never reuse a password. Two of the services below let you start without a card at all, which limits what there is to leak in the first place.

Is Muah AI free, and what does it cost?

Pricing is not published in a form we could verify. The site blocks automated reads, and no app-store listing gave us an in-app purchase list to work from.

Review sites quote figures, and they disagree with each other — the usual sign that they are copying one another rather than checking. We are not repeating numbers we could not confirm at source. Our methodology commits us to that, and it is the same rule that keeps every other price on this site checkable.

What we can say: a free tier is advertised, and the paid tiers are the point of the product. If you want a service where the price is on a public page before you hand over a card, three of the five below publish theirs.

The official site, the app, and the APK question

Most people who look this service up want something practical: the Muah AI official website, the app, and — a lot of them — an APK. Given the history above, each of those deserves a straight answer.

  • The Muah AI official site is muah.ai, and nothing else is. We could not read it: it returned HTTP 403 even to an ordinary browser user-agent, not just to a crawler. So we cannot tell you what it currently says, what a Muah AI login screen now asks for, or whether the terms changed — and neither can most of the sites claiming to review it.
  • The Muah AI app is real. It sits on Google Play under a name that doubles as its pitch — a Muah AI girlfriend chat — with the package com.muahaichat.app. That listing responds normally, which is more than the website does.
  • The App Store position is unclear. Our checks came back inconsistent, so we are claiming neither that it is listed nor that it was pulled.

On the Muah AI APK searches, the answer is no. A modified build is re-signed by whoever modified it, which means your password and session token pass through a stranger. That is the standard warning and it applies everywhere — but it applies twice over to a service that has already lost 1.9 million addresses along with what those people typed. If the data handling is the concern, installing an unofficial build of it is the opposite of a fix.

One search worth untangling: Muah AI cards mostly is not about this service at all. It belongs to the SillyTavern character-card ecosystem, where people trade character files between front-ends. Different tool, different problem.

What to use instead

The order below measures what someone leaving this service is likely to want: content that is not filtered, a company you can identify, and a price you can read before paying. It is a different question from «which is the best product overall», which our main ranking answers.

Every number comes from the provider’s own pages or store listings, checked in October 2026. Where there was no primary source, we say so instead of filling the gap.

1

SpicyChat AI

The closest thing in format
Freeno card needed

Same idea — a public library of characters written by users, uncensored, free to start. About 138,000 characters, group chats with up to four of them, and adult content permitted on the free tier rather than behind a paywall.

The free tier lands around 100 messages a day with no card. What you trade is machinery: 4,096 tokens of context on free, and no memory between conversations on any plan. Prices are published on the site, which is not true of every service on this page.

  • Prices published openly
  • No content filter
  • ~100 free messages a day
  • Community library
  • No memory between chats
2

CrushOn AI

For characters that remember
24Kof memory on top

The same open-library model, and it fixes the complaint SpicyChat does not: memory runs from 8K on free to 24K on the upper plans, and facts can be pinned by hand so they survive a long conversation. Adult content works from the free tier.

That free tier is the catch: 100 credits a month, roughly three messages a day. It shows you the interface, not the product. Judging it properly means paying, from $6.99 a month.

  • 24K memory
  • No content filter
  • Pinned facts
  • Free tier is a demo
  • English interface only
3

Candy AI

If text is not enough
120 svideo and calls

A different shape of product: fewer community characters, a real builder, and media the others do not have — live voice calls instead of a voice reading a message, video up to two minutes, and image generation that keeps the same face across hundreds of pictures.

It is also the only one here with a company inside the European Union, which changes what you can demand if something goes wrong. In exchange the free tier says almost nothing: about five messages, blurred images, adult content off. Media costs tokens on top of the $14.69 subscription.

  • Live voice calls
  • Video up to 120 seconds
  • European company, 14-day withdrawal
  • Free tier is useless
  • Tokens on top of the plan
4

OurDream AI

The most generous free tier
50 / dayfree messages

Video, voice calls and HD images sit inside the subscription instead of being metered separately, and memory carries across sessions. The free plan gives 50 messages and five images a day — along with SpicyChat, the only one here you can form an opinion about without paying.

The ceiling is coins: 1,000 a month, which testers report burning through in ten to twelve days of daily generation, and a video that fails costs the same as one that works. Moderation is also the most criticised part of the app.

  • 50 free messages a day
  • Video and voice included
  • Memory across sessions
  • Coins run out mid-month
  • Heavy-handed moderation
5

Infatuated AI

Cheapest multimodal plan
10 / chatfree messages

Chat, seven image styles, short videos and audio messages for under $7.50 a month on the annual plan. There is no public feed and no recommendation algorithm, which some people leaving larger platforms are looking for on purpose.

But every message costs a token, and a single ten-second Ultra video eats seventy of them. No community library to browse, free use capped at ten messages per conversation.

  • Seven image styles
  • Cheapest paid plan here
  • Every message costs a token
  • No community library
  • English only

How to choose

You want uncensored, and you want it free: SpicyChat. Adult content on the free tier, about 100 messages a day, no card. It is the closest replacement in format and the cheapest to test.

You want the character to remember: CrushOn from $6.99, with memory up to 24K and facts you can pin by hand. OurDream keeps memory across sessions too.

You want to know who you are paying: Candy AI is the only one here with a company inside the European Union, which brings a 14-day withdrawal right and stricter data rules. After reading this page, that may matter to you more than it did.

You want to see and hear, not just read: Candy AI for live calls and two-minute video, or OurDream if you would rather have everything inside one subscription than pay per generation.

Where we stand: we earn nothing from Muah AI — there is no affiliate link to it on this page, and that is a deliberate choice, not an oversight. We do earn from some of the services in the ranking, which is why their numbers are written out here for you to check rather than asserted. How we test is on our methodology page.

FAQ

Muah AI, quick answers

Taken from each provider’s own pricing and help pages, checked in October 2026.

  • Its 2024 breach exposed 1.9 million email addresses together with the image prompts attached to them, and Have I Been Pwned classifies it as sensitive, which restricts public search on the data. We found no public statement from the company about what changed afterwards, and the site blocks automated inspection, so its current terms and data policy cannot be checked from outside. Whatever it does today, the 2024 data is already out.
  • In September 2024 the platform lost roughly 1.9 million email addresses along with user-written prompts for generating images. The entry was added to Have I Been Pwned on 8 October 2024 and lists the exposed data as AI prompts, email addresses and sexual fetishes. Because the prompts were tied to the addresses that wrote them, affected users became identifiable, which is why the registry restricted public search on this particular breach.
  • An AI companion platform built around uncensored chat with a character, with image generation on top. An Android app exists on Google Play as Muah AI: AI Girlfriend Chat. Beyond that we can confirm little at source: the website returns an error to automated requests, so its pricing, terms and operating company could not be verified.
  • A free tier is advertised, but the pricing is not published in any form we could verify. The site blocks automated reads and there is no app-store purchase list to work from. Review sites quote amounts that contradict each other, so we are not repeating them. Three of the five services we recommend instead publish their prices on a public page.
  • It is a real service with a real app, not a scam in the sense of taking money and delivering nothing. That is a different question from whether it is a sensible place to put your data, and on that the 2024 breach is the evidence. Legitimate and safe are not the same word.
  • For uncensored chat that stays free, SpicyChat gives about 100 messages a day with no card. For a character that remembers, CrushOn runs memory up to 24K from $6.99 a month. If the breach is what brought you here, Candy AI is the only one on our list with a company inside the European Union, which means a 14-day withdrawal right and stricter rules on your data.