How to Check If Your AI Girlfriend App Already Leaked Your Data

Open a new tab, go to haveibeenpwned.com, type in the email you used to sign up for your AI companion app, and hit enter. That’s the whole first step, and most people who use one of these apps have never done it.

I keep a running tracker of AI companion app breaches, and the pattern across every entry is the same: users found out weeks or months after the fact, usually from a news article, not from the company that lost their data. A five-minute check now beats finding out from a headline later.

Have I Been Pwned is step one, not the whole answer

The short version: HIBP is free, takes one email address, and returns every breach dump it has indexed for that address. It’s the fastest way to check, and it’s also incomplete for this specific category.

Troy Hunt’s database aggregates leaked credential dumps from thousands of breaches and lets you search by email or phone number. For mainstream services it catches nearly everything, because a mainstream breach makes headlines, gets reported, and gets loaded into HIBP within days. For AI companion apps specifically, coverage is spottier, because several of the worst breaches in this category were disclosed by security researchers or journalists rather than the companies themselves, and not every one of those disclosures makes it into a structured HIBP entry with a clean, importable credential list.

Muah.AI’s 1.9 million email breach is indexed, because it was a fairly clean email-address dump that made it into the usual channels. The Chattee and GiMe leak of 43 million messages (reported by Cybernews in 2025) is a murkier case for an aggregator: message content and metadata rather than a clean username-and-password list, which is exactly the kind of breach that’s harder to catalog in a searchable index built around credential pairs. HIBP is built to answer “was my password in this dump,” not “was my private conversation in this dump,” and AI companion breaches increasingly look like the second kind.

Why these breaches keep happening

The short version: Security researchers keep finding the same handful of basic mistakes across independent AI companion apps: credentials baked directly into the app, screens that load untrusted content with scripting enabled, and tokens anyone can extract by decompiling the APK.

This matters for the check you’re about to run, because it explains why “no news article yet” is such a weak signal. Oversecured, a mobile app security research firm, published findings in March 2026 after examining AI companion and chatbot apps from independent developers on Google Play. What they found was not a single dramatic hack, it was a pattern of ordinary carelessness repeated across the category:

• One productivity-adjacent chatbot shipped with a hardcoded OpenAI API token and a Google Cloud service account private key sitting directly in the app package, retrievable by anyone who decompiled it, no breach required in the traditional sense.
• A multi-voice companion app had an exported screen that accepted raw HTML and loaded it straight into a WebView with JavaScript turned on, an injectable-code path that a malicious link or crafted input could exploit.
• A metaverse-style companion app had hardcoded authentication tokens baked into the client.
• Multiple chatbot apps had host-validation flaws that could redirect a user to an attacker-controlled site under the right conditions.

None of these are the kind of sophisticated, nation-state-grade attack you picture when you hear “breach.” They are the kind of shortcut a small team takes when it’s shipping fast and nobody on staff owns a security review. The unsettling part is how ordinary that is across the category, and it’s a big part of why checking HIBP once is not the same as confirming an app is safe. A vulnerability like a hardcoded key can sit live in a shipped app for months before anyone outside the company notices, and it may never generate a headline at all if nobody exploits it in a way that gets reported.

Cross-reference the app by name, not just your email

The short version: If your email doesn’t show up on HIBP, that tells you your credentials weren’t in a dump HIBP has seen. It does not tell you the app itself has a clean record.

This is the step people skip. Search the tracker (or a general news search) for the specific app’s name plus “breach” or “leak.” I update mine with dates and named sources, not vague “reportedly”: Muah.AI (Malwarebytes, HIBP, 2024), Replika’s EUR 5 million GDPR fine from the Italian data protection authority (EDPB, April 2025), Chattee and GiMe’s 43 million messages (Cybernews, August 2025), Chat & Ask AI’s roughly 300 million exposed records (Malwarebytes, February 2026).

If you use one of the apps on that list, your email not appearing on HIBP means nothing. The breach may have exposed message content without a clean password dump, or it may simply not have been indexed yet. Each entry on a well-maintained tracker should carry a specific source you can click through and verify yourself, not a secondhand summary. If a claim about a breach can’t be traced to a named outlet, security firm, or regulator, treat it as unconfirmed rather than repeating it as settled fact, the same standard I hold myself to when I add a row to my own tracker.

What actually got exposed matters more than whether you were “in a breach”

The short version: A password in a breach is bad but fixable, change it. A private conversation in a breach is not fixable, it’s already out.

This is the distinction that makes AI companion breaches different from your average retailer leak. When a shopping site gets breached, you rotate a password and maybe watch your card statement for a few months. When Chattee and GiMe leaked 43 million messages, per Cybernews’ reporting, what got exposed was the actual content people typed, sometimes deeply personal, tied to identifiable accounts. There’s no password reset for that. Once a private conversation is in a leaked dataset, it stays in that dataset, copied to however many places it’s already spread, regardless of anything you do afterward.

So when you check HIBP and it comes back clean, ask the follow-up question: does this app store full conversation logs on its own servers regardless of breach history? If the answer is yes, “not breached yet” is a timer, not a guarantee. The Oversecured findings above are the reason that timer keeps running quietly in the background even when nothing has made the news, a live hardcoded key or an injectable WebView is a breach waiting to be discovered, not a breach that hasn’t happened.

Password reuse is the multiplier that makes a small breach into a big one

The short version: A breach at one AI companion app only stays contained to that one app if you never reused the password anywhere else.

This is worth stating plainly because it’s the single most common way a modest breach turns into something worse. If the email-and-password pair exposed in a companion app breach is the same pair you use for your email account, your banking login, or any other service, a breach that started as “an AI chat app leaked my data” can cascade into accounts that have nothing to do with AI companions at all. HIBP’s results page will often flag whether a specific breach exposed passwords in a crackable format, and if it did, the safe assumption is that any account sharing that password is now at risk, not just the one that was actually breached. A password manager that generates a unique password per service removes this multiplier entirely, so a breach at one app stays contained to that one app, which is worth setting up regardless of which companion app you use. Two-factor authentication, where the app offers it, adds a second layer that a leaked password alone can’t get past, though it’s worth noting that plenty of apps in this category still don’t offer it at all, which is itself worth checking before you sign up for one.

The five-minute routine, in order

The short version: Email on HIBP, app name on the tracker, then check the app’s own privacy policy for what it retains, in that order.

1. Enter your email at haveibeenpwned.com. Note anything that comes back, including services you’d forgotten you signed up for.
2. Search the app’s name plus “breach,” “leak,” or “data” and check the breach tracker for a dated, sourced entry.
3. Open the app’s own privacy policy and look specifically for how long it retains chat content, not just account data. Most companion apps bury this; if you can’t find a retention period stated in plain numbers, that’s itself the answer.
4. While you’re there, register your email with HIBP’s free notify service, so a future breach reaches your inbox instead of waiting for you to think to check again.
5. Decide what you’re comfortable with, knowing all of the above, not just the parts that came back clean.

Or skip the routine entirely

The short version: A server with nothing on it can’t leak. Local Waifu runs the model on your own machine, so there is no account database to breach and no chat log sitting on someone else’s server.

I built Local Waifu specifically so this checklist would have a one-line answer for it: nothing to check, because there’s no server holding your conversation. No email required to use the app itself, no chat history uploaded anywhere, nothing for HIBP to ever need to index, and no hardcoded cloud credential sitting in the app package for a researcher to find, because the app doesn’t hold a cloud credential that could expose your data in the first place.

You can verify it the blunt way, same as I tell people checking any “runs locally” claim: block the app’s network access and keep talking to her. She still replies, because the model generating those replies never needed the internet in the first place. There’s no equivalent of the Oversecured findings to worry about here, not because I’m claiming perfect code, but because the entire class of vulnerability those researchers found (a hardcoded key that leaks your conversation to a cloud provider, an exposed database holding millions of chats) requires a cloud backend to exist at all. Remove the backend, and that whole category of risk goes with it.

If you’ve already run the HIBP check on your current app and didn’t love what you found, try the version that has nothing to leak. Seven days free, no card, no email required to start.

Questions people ask

Back to the blog