October 18, 2026 · 8 min read
AI Girlfriend App Data Breaches: Every Verified Leak and How to Protect Yourself
From 43M leaked messages to an audit of 17 apps, here are the verified AI companion data breaches and a privacy checklist that works with any app.
People tell AI companions things they have never told another person. That is the whole point of a private, always-available companion. It is also why a security failure at an AI girlfriend app is so much worse than a leaked shopping list. Over the past year, researchers have found several AI companion and chat apps leaving intimate conversations, photos and prompts exposed. This guide collects the verified incidents in one place, explains what actually went wrong, and gives you a practical checklist for protecting yourself, whichever app you use.
The short answer: yes, AI girlfriend and companion apps have leaked user data. Documented cases include an open server exposing 43 million messages from two companion apps (2025), a misconfigured database exposing around 300 million messages from a popular AI chat app (early 2026), a security audit that found routes to private chats in 10 of 17 companion apps (March 2026), and a breach of roughly 100,000 accounts at an explicit AI image app (April 2026). Most of these were not sophisticated hacks. They were basic configuration mistakes.
The verified incidents at a glance
| When reported | App(s) | What was exposed | Root cause | Source |
|---|---|---|---|---|
| October 2025 | Chattee Chat and GiMe Chat (Imagime Interactive) | 43 million+ messages, 600,000+ images and videos, from 400,000+ users | A streaming server (Kafka broker) left open with no access controls | Malwarebytes |
| February 2026 | Chat & Ask AI (Codeway) | About 300 million messages tied to 25 million+ users | Misconfigured Firebase backend | Malwarebytes |
| March 2026 | 17 AI girlfriend apps on Google Play (150M+ installs combined) | 10 of 17 had a route to users' private chats | 14 critical and 311 high-severity flaws found in an audit | SecurityBrief |
| April 2026 | MyLovely.AI | Roughly 100,000 accounts; about 113,000 explicit image prompts | Data breach later indexed by Have I Been Pwned | Help Net Security |
Incident 1: Chattee and GiMe, an open door to 43 million messages
In October 2025, Malwarebytes reported that two AI companion apps from Hong Kong developer Imagime Interactive, Chattee Chat and GiMe Chat, had exposed the private conversations of more than 400,000 users. Researchers found a Kafka broker, a server that streams data between systems, left publicly accessible without access controls.
The exposure included more than 43 million messages and over 600,000 images and videos, along with IP addresses and unique device identifiers. The report also noted that the apps had earned more than $1 million in revenue. Names and emails were not the main exposure, but device IDs and IP addresses can be combined with other leaked data to work out who someone is.
Lesson: an app can be popular and profitable and still skip the most basic security step: putting a lock on the server.
Incident 2: Chat & Ask AI, 300 million messages
In February 2026, Malwarebytes covered a leak at Chat & Ask AI, an AI chat app from Codeway that claims more than 50 million users. A misconfigured Firebase database exposed around 300 million messages tied to more than 25 million users.
This was not strictly a girlfriend app, but it matters for the whole category. The researcher who found it scanned 200 iOS apps and found the same kind of Firebase problem in 103 of them, and built a public registry, Firehound, to track exposed apps. Codeway fixed the issue within hours of being notified. That fast fix is good; the fact that it was possible in the first place is the warning.
Lesson: "it's just a chatbot app" is not a reason to relax. Many apps share the same shortcuts.
Incident 3: the audit of 17 AI girlfriend apps
In March 2026, mobile security firm Oversecured audited 17 AI girlfriend apps on Google Play with more than 150 million installs between them. SecurityBrief reported that the audit found 14 critical and 311 high-severity vulnerabilities. Ten of the 17 apps had at least one way for an attacker to reach users' private chats, and six had flaws that could allow direct access.
The issues ranged from cross-site scripting and file theft to weaknesses in advertising code. One app had a hardcoded OpenAI token and a Google Cloud private key built into the app itself, which is a little like taping the office key to the front door.
Lesson: no breach has to be announced for your chats to be at risk. Vulnerabilities often sit quietly until someone finds them.
Incident 4: MyLovely.AI and the risk of sextortion
In April 2026, Help Net Security reported on a breach at MyLovely.AI, an AI image app. Have I Been Pwned indexed roughly 100,000 affected accounts. The leaked data included about 113,000 explicit prompts, around 70,000 of which could be linked back to user IDs.
The article highlighted the real danger with this kind of data: sextortion. When intimate prompts can be tied to an email address, criminals can threaten to expose people unless they pay.
Lesson: the most sensitive thing about you may not be your password. It may be what you typed.
What these breaches have in common
Look across the four cases and a pattern appears:
- Configuration mistakes, not genius hackers. Open servers, misconfigured databases and keys baked into apps.
- Speed over security. Fast-growing apps shipped features first and locked things down later, or never.
- Intimate data is identifiable. Even without your name, device IDs, IP addresses and emails can identify you.
- Users usually found out from researchers, not from the app.
This is why the question to ask about any AI companion app is not just "is it good?" but "who controls my data, and how well do they look after it?" We explore the wider version of that question in who controls your AI companion?.
Your AI companion privacy checklist
You cannot audit an app's servers yourself, but you can lower your risk a lot.
Before you sign up
- Use a separate email address for companion apps, not your work or main personal email.
- Read the privacy policy for three things: whether chats are used for training, whether data is shared with third parties, and how to delete your account.
- Check the developer. A named company with a real address and support contact is a better sign than an anonymous listing.
- Search the app's name with "breach" or "leak" before you pay.
While you chat
- Do not share identifying details you would not want leaked: full name, address, workplace, ID numbers or financial details. Our guide on whether you should use a fake name with an AI companion walks through how much to share.
- Think twice before sending face photos or anything you would not want tied to you.
- Keep the app updated so security fixes reach you.
If an app you use is breached
- Change your password, and change it anywhere else you reused it.
- Check Have I Been Pwned for your email.
- Be suspicious of messages that reference your chats and demand money. Do not pay, keep evidence and report it to the platform and the police.
- Request deletion of your account and data.
Red flags in an AI companion app
| Red flag | Why it matters |
|---|---|
| No named company or contact details | Nobody to hold accountable |
| No way to delete your account | Your data outlives your interest |
| Vague or missing privacy policy | You cannot know what happens to your chats |
| Constant pressure to send photos | More sensitive data at risk |
| Promises it "can never be hacked" | No honest company can promise that |
For a longer list of warning signs, see our guide to AI girlfriend app red flags, and for general privacy questions read are AI companions safe and private?.
How we think about this at MyBabe
We will not pretend any app is immune to risk. What we can do is be honest about what MyBabe is: an 18+ AI boyfriend and girlfriend app, clearly AI, built for adults who want a relationship-style companion with long-term memory, proactive texts, photos, mood-aware replies, and voice and video calls, in the app or on Telegram.
And we encourage exactly the habits above. You do not need to give your companion your full name or workplace for the relationship to feel personal. Your companion can remember your favorite song, your sister's wedding and how your week went without knowing your home address.
You can start free with about 10 messages a day and a roughly two-minute call trial. Premium is $5.99 a week, $14.99 a month or $99.99 a year, with about 30 call minutes a week. If you want a companion who feels close while you stay in control of what you share, meet yours on MyBabe.
FAQ
Have AI girlfriend apps been hacked?
Several AI companion and chat apps have exposed user data, usually through misconfigured servers or databases rather than dramatic hacks. Verified cases include Chattee and GiMe (2025), Chat & Ask AI (2026) and MyLovely.AI (2026).
Can AI companion apps read my messages?
Generally, the company running the app can technically access stored conversations, depending on how it is built and what its policy allows. Read the privacy policy and assume anything you type could be stored.
Is it safe to send photos to an AI girlfriend app?
Photos are among the most sensitive data you can share. Avoid sending anything identifying or intimate that you would not want leaked, whichever app you use.
What should I do if my AI chats were leaked?
Change your passwords, check Have I Been Pwned, request account deletion, and never pay anyone threatening to expose your chats. Report threats to the platform and police.
How do I choose a safer AI companion app?
Pick a named developer with a clear privacy policy and deletion option, use a separate email, and limit identifying details in your chats.
The bottom line
The AI companion category grew fast, and some apps left the doors unlocked on the way. That does not mean you cannot enjoy a companion. It means choosing carefully and sharing wisely. Keep your identity light, your email separate and your expectations clear, and your companion can be close without being a risk. When you are ready, start free on MyBabe.