Suno: Hacking Reveals AI Training on YouTube

An Intrusion That Sheds Light on Suno's Practices

For several years, musicians, streaming platforms, and record labels have expressed concerns about the use of their works by artificial intelligence companies to develop musical tools. Suno, a company specializing in creating audio clips and songs generated by AI, is at the center of this controversy. A recent hack of its source code revealed that Suno trained its AI by massively collecting music tracks and lyrics from platforms such as YouTube Music, Deezer, Genius, as well as royalty-free music libraries. This information was highlighted in a report by 404 Media published on Wednesday.

The hacker, using the pseudonym ellie.191, exploited a vulnerability in the supply chain in November 2025. Screenshots and data shared with 404 Media confirm some of the data sources used by Suno for the years 2023 and 2024. One file shows that at its last consultation, a folder named "youtube_music" contained over 2 million clips. Other files reveal the existence of more than 17,000 hours of music from Genius HQ, over 12,000 hours from Deezer, and more than 62,000 hours from a royalty-free music site owned by Shutterstock, called Pond5. The hacker also managed to access client files and payment details managed by Suno's payment service provider, Stripe, according to 404 Media.

A representative from Suno told CNET that the company immediately launched an investigation into this breach. According to him, it primarily concerned outdated source code that is no longer in use at Suno, and no sensitive personal data was compromised. The company also denied having access to customers' full credit card numbers and concluded that it was not required, under current privacy laws, to individually inform users.

AI-Generated Music in the Spotlight

With the rising popularity of AI-generated songs, often shared on social media, it is crucial to understand how these technologies work. Although the source code exposed by the hack is no longer active, it offers a rare glimpse into the "black boxes" that tech companies keep closely guarded during the development of their generative AIs. This revelation also seems to lend credence to the numerous copyright infringement accusations leveled against Suno.

A professional association comprising major record labels, such as Universal Music Group, Sony Music Entertainment, and Warner Music Group, has filed a lawsuit against Suno. It accuses the company of using its artists' songs without consent or proper licensing, thereby infringing copyright. Like other AI companies, Suno argues that its use of original material to train its models is legal, invoking the doctrine of fair use. Companies like Anthropic and Meta won similar lawsuits last summer against authors claiming infringement of their rights.

A source close to the matter told CNET that the company does not consider the information in the 404 Media article to be "materially new," as it had already disclosed its training methods in a public filing and on a page of its website. "Suno's generative music AI models are trained on publicly available music files and related metadata accessible on third-party sites on the open internet," its site states.

Implications for the Music Industry

These lawsuits highlight the growing tensions in the creative industries. Tech companies like Suno claim to want to support the creative process and democratize access to music creation. However, human artists decry the use of their work without permission, resulting in cheap imitations known as AI slop, which executives use to cut labor costs.

Some publishers and copyright holders have struck deals with AI companies for the use of their content. Additionally, AI companies have implemented certain measures to prevent deepfakes and explicit copies: for example, Suno does not allow the creation of a pop song in the style of Taylor Swift. However, these precautions have not been enough to assuage artists' concerns. Even when agreements are reached between record labels and AI companies, such as the one between UMG and Suno to resolve another dispute, musicians claim they have not received compensation for the use of their works.