Muah AI Safety Rating Index

Muah AI presents the most concerning safety profile of any AI companion app in our coverage. In September 2024, a data breach exposed 1.9 million user accounts, including email addresses paired with intimate AI-generated image prompts. Have I Been Pwned classified this as a Sensitive Breach alongside Ashley Madison. The leaked data contained prompts describing child sexual abuse scenarios, prompting the Australian eSafety Commissioner to issue a formal advisory warning about CSAM risks on the platform. The hacker who breached the system described it as open-source projects duct-taped together with trivially exploitable vulnerabilities. Reports of extortion using the stolen data emerged within weeks, including coercing affected employees into compromising their employer systems. The platform operates under confusing corporate entities: Harvard Han founded the original in Los Angeles, while the current iOS version lists STARSHINE INFINITE TECHNOLOGY LIMITED as seller, registered in Anguilla. The privacy policy and terms of service are branded as Spicy AI on a third-party domain, creating accountability gaps for users who cannot determine which entity controls their data. The privacy policy claims to collect device IDs, names, contact details, financial information, birth dates, ID documents, and address verification, which is far broader than necessary for a chat app. No GDPR or CCPA rights are documented. Exodus Privacy found 5 trackers including Facebook Ads and Google AdMob in the Android app despite it being a paid service. The Android app was removed from Google Play. No safety center, crisis resources, parental controls, or meaningful content moderation exist.