AI companion site Muah.AI hacked, exposing user emails tied to submitted prompts

What happened

The uncensored AI companion service Muah.AI was breached by a hacker who described the site as loosely assembled open-source components. The stolen data linked personal email addresses to prompts users had submitted, some describing illegal content.

Impact

Around 1.9 million email addresses were exposed alongside associated chatbot prompts, some describing illegal exploitation scenarios.

How this could have been prevented

Sensitive-content AI services need real security engineering rather than duct-taped open-source stacks, plus segregation of identity data from prompt data.

Sources

More data leakage incidents

Autonomous AI agent breached McKinsey's Lilli platform in two hours Anthropic leaked Claude Code's full source via an npm source-map packaging bug ChatGPT DNS covert channel let a single prompt exfiltrate conversation data

Would runtime governance have caught this?

Guardion enforces policy on every agent action inline — with visibility, tamper-evident evidence, and DLP for agents and MCPs.

Request a demo