A recent data breach at Muah.AI, an “AI girlfriend” site, has exposed the email addresses and sensitive chatbot interactions of 1.9 million users, including highly explicit content.
The breach, which occurred on September 17, 2024, was added to the “Have I Been Pwned” (HIBP) database yesterday, triggering notifications to affected users. Along with email addresses, the leaked data contains prompts used to generate AI-based interactions, many of which describe sexual fantasies, including disturbing scenarios involving child exploitation.
The breach was first reported by 404 Media, which revealed the extent of the leaked data. According to their report, the hacker responsible for the breach described the site as poorly constructed, consisting of “duct-taped” open-source projects that made it easy to exploit vulnerabilities. While initially driven by curiosity, the hacker decided to contact 404 Media after uncovering a disturbing pattern in the database, where many prompts focused on child sexual abuse.
Muah.AI allows users to create customizable AI companions for intimate interactions, advertising itself as an uncensored platform that enables sexual conversations and images. While the site claims to prohibit underage content, the leaked data shows users attempting to create prompts describing illegal and abusive activities, which were still stored in the database. The breach exposes not only these prompts but also ties them directly to users’ personal email addresses, many of which appear to belong to real individuals.
Following the breach, HIBP added the compromised data to its database, allowing those affected to check if their information was involved. Notifications have been sent to users who have registered for breach alerts, warning them of the exposure of their email addresses and associated explicit prompts.
HIBP's founder Troy Hunt explained on a thread on X that most email addresses in the database are not disposable addresses from anonymous services, but rather exposing addresses easily tied to people's identities and even LinkedIn accounts. Also, the verification process on the site leaves little doubt that the rightful owners of these addresses were in control of the Muah accounts, and hence responsible for the explicit prompts.
Muah.AI’s administrator, Harvard Han, responded to the reports, claiming the breach was the result of a targeted attack by competitors within the uncensored AI industry. He insisted that the platform enforces content moderation, particularly regarding underage content, and that the company removes such material. However, the breach suggests that Muah.AI's moderation systems were insufficient to prevent users from attempting to generate harmful content.
Although the breach was disclosed by a single hacker, the poor security infrastructure of Muah.AI raises the likelihood that other malicious actors, or even law enforcement agencies, may have accessed the database prior to the disclosure. The lack of robust protections likely left the platform open to unauthorized access for an extended period, amplifying the likelihood that users were exposed more than once.
Critical Firefox Zero-Day Vulnerability Exploited in the Wild
Leave a Reply