Muah AI Review 2026: Why Its 2024 Breach Makes It Hard to Recommend

The breach is the most important fact about Muah AI, and its essentials are well documented. A hacker told 404 Media the site was “basically a handful of open-source projects duct-taped together” and that they “found some vulnerabilities relatively quickly”.

The database they took tied users’ email addresses to the prompts they had written for their AI companions.

What Was Exposed

• Email addresses: 1,910,261 of them. Many “appear to be personal accounts with users’ real names”, 404 Media found, and Linklaters noted that the site verified addresses at sign-up.
• AI prompts and sexual preferences: HIBP lists “AI prompts” and “sexual fetishes”: the instructions users gave their companions, linked to their addresses.
• Not listed: HIBP does not list passwords or payment details among the leaked data.

The Child-Abuse Prompts

The gravest finding concerns what some users asked for. HIBP’s record says “many of the prompts were highly sexual in nature, with many also describing child exploitation scenarios”.

404 Media found that “in many instances” users were trying to create chatbots that role-play child sexual abuse. Troy Hunt, who runs HIBP, wrote that such material, or at least requests for it, was “rampant” throughout the system.

Muah AI’s administrator said a moderation team deletes all child-related chatbots. Yet 404 Media reported that when two people posted about a reportedly underage character on Muah’s Discord server, a moderator told them to take it to private messages.

The fallout goes beyond embarrassment. In a 14 October 2024 analysis, the law firm Linklaters noted that in the UK, making or possessing AI-generated child-abuse “pseudo-images” is “a very serious criminal offence”, and it compared the blackmail risk with the 2015 Ashley Madison breach.

Extortion attempts were reported within days, although Malwarebytes said it was unclear whether they drew on users’ activity or only on the leaked addresses.

Because HIBP classes the Muah breach as sensitive, a public search of HIBP will not show it. Only the verified owner of an address can see whether it is listed.

1. Check privately. Sign in to the Have I Been Pwned dashboard with the address you used, or sign up for its Notify Me alerts. HIBP sends a verification link to that address; once you confirm it, the Muah breach appears under Breaches if you were in it.
2. Delete the account. Muah’s user guide puts Delete Account in Settings, and a separate Wipe Cloud Data tool erases cloud chat history and settings. The privacy policy also lets you request deletion by emailing love@muah.ai. Deleting removes what Muah still holds; it cannot recall data that was already stolen.
3. Stop any subscription in Muah’s settings, by email or through your payment provider, as the Terms allow.
4. Change the password anywhere you reused the one you set on Muah. Passwords are not among the leaked data HIBP lists, but it is sensible after any breach.
5. If someone threatens you with the leak, do not reply or pay. Keep the messages and report them to the police; in the US, the FBI’s Internet Crime Complaint Center takes extortion reports.

Malwarebytes’ advice after the breach applies to any app of this kind: do not sign in with a Google or other mainstream account, or with your everyday email address. Muah AI offers Google and Discord sign-in alongside email.

Muah AI did not shut down. On 6 October 2026 muah.ai was live, with new user guides dated 3 October 2026. What we could not find is any public account of what went wrong in 2024 or what was fixed.

• No published security changes. We found no statement on Muah’s site about the breach or new safeguards, and no follow-up reporting in 2025 or 2026.
• Policies still dated 2022. The Terms and the Privacy Policy both carry an effective date of 17 May 2022. The policy promises only “reasonable security measures” and says nothing about how long chats are kept, where they are stored or whether they train AI models, while the About page describes models that train themselves on an “ever increasing dynamic data training set”.
• A privacy claim at odds with the record. Muah’s About page says conversations are “advance encrypted thru SSL” and that “whatever happens inside the platform, stays inside the platform”. SSL protects data in transit; it did not stop a database being copied in 2024.
• No two-factor login. Sign-in is by email and password, Google or Discord, and no second factor is documented.
• Thin content rules. The Terms ban illegal use in general and refer to “Standards of Conduct” that we could not find published. We found no standalone policy on minors, real people or deepfakes. You can build a character from an uploaded photo, and the guide lists adult image tools called Photo X-Ray and Advanced X-Ray; the only rule it states is to use “adult fictional characters and images you have permission to use”.
• Self-declared age gate. You confirm you are 18 or over by continuing; no verification method is documented.
• No store apps. The App Store and Google Play listings now return “not found”, and the About page calls store apps using Muah’s name “scam/phishing apps”, yet the homepage offers an Android APK last updated in November 2024.

Set the breach aside and Muah AI documents a broad feature list. Everything below comes from Muah’s own user guide and VIP page, not from use, and no independent source we found measures the quality of its writing, images or memory.

• Characters: premade companions, a community card library, or your own character built from a name, a description and an uploaded image.
• Chat models: a choice of “AI cores”, with automatic fallback to another model. The VIP page says the two upper tiers are “powered by” GPT-5 or Grok for the first 30 or 100 chats a day, which sits awkwardly with the About page’s talk of proprietary AI. If accurate, those chats pass through outside AI providers, which the privacy policy covers only as “third-party service providers”.
• Voice and calls: voice messages, spoken versions of replies and live calls, which the VIP page lists only for Ultra VIP, capped at 30–60 minutes a day.
• Images and video: photos generated from an appearance description, 4K enhancement and short videos made from images, some with audio. A music generator is listed too.
• Memory: how much past conversation the AI can use depends on your plan, with a summary carrying older facts forward.
• Interface: seven languages (English, Chinese, Japanese, Spanish, Hindi, French and Russian). The login and checkout panels are branded “Fevermate”, a name Muah’s pages do not explain.

Muah markets all of this as “uncensored”, though its uncensored-AI guide concedes that models “may have different behavior or restrictions”. Without independent testing there is no basis for rating the output, and the 2024 leak showed that the uncensored stance came with weak moderation.

Muah AI has a free account and three paid tiers. These are the US-dollar prices on Muah’s VIP page and in the chatroom’s plan panel on 6 October 2026. Older third-party listings of a $9.99 entry tier do not match the current page.

There is no separately sold token currency, but the guide says some extras “spend levels” of the XP shown in the chatroom footer, and video shows a generation cost that changes with clip length.

• Payment: card or crypto. Card checkout opens in a new tab on a separate payment site. Muah promises an “SFW Bank Statement”, and its payment page code says charges appear as “USWEIXIN” or “AI DRAMA”.
• Refunds: the Terms say subscriptions “are NOT refundable”. Support may grant a one-time partial or full refund “upon good faith”, Muah says it will counter-dispute chargebacks, and its payment page code warns that disputing a charge gets the account permanently banned.
• Cancelling: any time, in Muah’s settings, by emailing love@muah.ai or through the payment provider.

The yearly VIP plan is cheap for the category, but price is not the deciding question: paying links your card, and usually your name, to a service that has already lost its users’ data once.

None of these is risk-free. Each has its own review on this site, and the ratings and caveats below come from those reviews.

If Muah’s lack of filters was the draw, note the trade-off: Candy AI and Kindroid have firmer content rules, while Janitor AI and SpicyChat are closer to Muah in permissiveness but leave more of the privacy burden with you.

This is a research-based review.

On 6 October 2026 it drew on Muah AI’s homepage, VIP page, chatroom plan panel, user guide, About page, Terms and Privacy Policy; Have I Been Pwned’s breach record; reporting by 404 Media, Malwarebytes and CyberInsider; Troy Hunt’s notes; Linklaters’ legal analysis; US trademark records; and App Store, Google Play and Trustpilot searches.

No subscription was bought and the product was not used, so feature descriptions come from Muah’s own pages and the feature and content scores carry low confidence. With no store listings and only four Trustpilot reviews, no meaningful user rating exists.

The safety record overrides the other scores: the overall is capped at 4.0, below the 5.1 sub-score average. An earlier version of this page scored Muah AI 4.5.