Suno hack exposes how it scraped YouTube Music, Deezer for AI training
A Suno source-code leak reveals the AI music generator scraped millions of YouTube Music, Deezer and Genius tracks to train its models, adding new evidence to major labels' copyright lawsuits.
NEWS
7/23/20262 min read
A supply-chain hack has revealed new details about how Suno, one of the best-known AI music generators, gathered audio to train its models, adding fresh material to an ongoing fight over copyright and artist consent. Source code reviewed by 404 Media suggests the company pulled content from YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, IMSLP and large podcast libraries.
The leaked logs point to more than 2 million YouTube Music clips, 113,879 hours of YouTube Music audio, 17,615 hours from Genius and 12,287 hours from Deezer, plus tens of thousands more hours pulled from stock audio libraries. The late-2025 breach also exposed customer email addresses, phone numbers and partial Stripe payment details. Suno says no full credit card numbers were compromised and that the leaked source code was outdated and no longer in use.
The files also detail how Suno built its training library. The code includes instructions to filter out non-music content, search YouTube specifically for a cappella recordings to isolate vocals, and route around platform protections using Bright Data proxies. Other files reference plans to pull roughly 1 million hours of podcast audio through PodcastIndex.
The leak doesn't settle the legal fight on its own, but it adds context to lawsuits filed by Universal Music Group, Sony Music Entertainment and other major labels, which accuse Suno of bypassing YouTube's anti-scraping measures and copying copyrighted recordings at scale. The Recording Industry Association of America has separately alleged the company engaged in stream ripping, an accusation the leaked code appears to support.
Suno maintains its models were trained on music that was publicly available on the open internet and that the practice falls under fair use. The company says its system is built to generate original music and includes safeguards meant to stop users from reproducing existing songs. Suno also says the breach was contained quickly, which is why affected users weren't notified.
The leak raises questions that extend past Suno alone. Artists including SZA and Kenneth Blume have already spoken out about their songs turning up in AI training datasets without permission, with concerns that unreleased material could have been swept in as well.
As the lawsuits move forward, the leaked code offers one of the clearest looks yet at how a major AI music platform assembled its training data, a detail likely to keep the debate over copyright, transparency and user privacy running for a while yet.
Images: Simon Lehmann via Dreamstime | SUNO