Suno Hacked: YouTube Data Exploited for Music AI

The AI music generator Suno is at the center of a controversy after being hacked, as reported by 404 Media. The hacker used a supply chain attack to obtain an employee's credentials, allowing access to Suno's source code. This code reveals that Suno allegedly extracted decades of audio from platforms such as YouTube Music, Deezer, Genius, as well as royalty-free music libraries and podcast RSS feeds.

Suno had already acknowledged training its AI with publicly available music files on the Internet, justifying this practice under the doctrine of fair use, a subjective exception to copyright law. However, major record labels, which are suing Suno, argue that this practice is illegal under the Digital Millennium Copyright Act (DMCA), particularly regarding the circumvention of YouTube's protections against data scraping, which also violates YouTube's terms of service.

Additionally, Udio, a competitor of Suno, is also accused of scraping data from YouTube. Google, the parent company of YouTube, is facing similar copyright infringement allegations from several major book publishers.

The hacker is also said to have accessed Suno's customer data, including email addresses, phone numbers, and partial credit card numbers stored in Stripe. Suno did not inform its customers of this breach, which occurred in November 2025, and claims it was a "limited security incident that was quickly contained."