A breach at Muah AI exposed 1.9 million emails, and reporting tied part of it to child exploitation material

This one is older than the others on this list but keeps resurfacing because it's the clearest cautionary data point the AI companion industry has produced so far. Independent security researcher Troy Hunt added the incident, confirming roughly 1.9 million exposed email addresses tied to user accounts and private chat prompts.

• 1.9 million exposed email addresses
• Tied to user accounts and private chat prompts
• Confirmed by security researcher Troy Hunt

What made this breach different from a typical email leak is what was inside the exposed data. Outlets including 404 Media, Malwarebytes, and The Atlantic reviewed portions of the leaked prompts and reported that some described child sexual abuse material, which multiple legal and cybersecurity analyses flagged as carrying real extortion risk for the real people behind those accounts, since the leak tied prompts directly to email addresses. Australia's eSafety Commissioner later named the platform directly in its public safety guidance, citing the breach.

• Some leaked prompts described child sexual abuse material
• Leak tied prompts directly to email addresses, creating extortion risk
• Australia's eSafety Commissioner named the platform in safety guidance

Muah AI's app was pulled from Google Play at that time, where it had held a 3.82 out of 5 rating across 470 reviews before removal, and the platform now distributes only through the Apple App Store and sideloaded Android files. The company has said it made security improvements since the breach.

• App pulled from Google Play (had 3.82/5 rating, 470 reviews)
• Now distributed only through Apple App Store and sideloaded Android files

For an industry where the entire product is built on people sharing intimate, personal conversation with a chatbot, this remains the reference case for what happens when that trust is misplaced.