Source Code Hack Reveals Suno’s AI Was Trained on Millions of YouTube Songs

Musicians, streaming services and record labels have been demanding it for years AI music services use their large collections of human-created music to build their artificial intelligence tools. We now have a clearer picture of how Suno, an AI company that helps people create AI audio clips and songs, created its music.

A hack of Suno’s source code reveals that it trained its AI by extracting large amounts of music and lyrics from platforms such as YouTube Music, Deezer, Genius and stock music libraries, 404 Media reported on Wednesday.

The hacker, who goes by the moniker ellie.191, used the supply chain attack vector in November 2025. Screenshots and information shared with 404 Media confirm some of the origins of the company’s training data from 2023 and 2024.

One file shows that, the last time it was opened, there were more than 2 million clips in a folder called “youtube_music.” The other files contain more than 17,000 hours of music from Genius HQ, more than 12,000 hours from streaming service Deezer and more than 62,000 hours from a stock music site owned by Shutterstock called Pond5. The hacker also gained access to customer records and payment information stored by Suno’s payment vendor, Stripe, 404 Media reports.

A Suno spokesperson told CNET that the company immediately investigated the breach and found that it “primarily involved old source code that is no longer used at Suno and that no personal information was compromised.” The company also denied it had access to customers’ full credit card numbers and concluded that, under current privacy laws, it did not need to notify individual users.

It pulls back the curtain on AI-generated music

With the new trend of people creating songs by exchanging text messages, you may have heard some of Suno’s AI-generated songs on social media. As sites like Suno gain popularity, it’s important to know how they work.

Even though the source code shown in the hack is no longer functional, it’s a different view from the watchdogs of black box technology companies as they build productive AI. And it seems to confirm many of the allegations in the copyright infringement lawsuits brought by Suno.

A trade association representing major record labels, including Universal Music Group, Sony Music Entertainment and Warner Music Group, is suing in the ongoing lawsuit that Suno’s use of artists’ songs, without proper permission or licensing, violates their copyright protection.

Like other AI companies, Suno wants its use of original material since the training data is legal under the fair use doctrine in copyright law. Anthropic and Meta won similar cases brought by the authors who claim to be breaking the law last summer.

A source close to the case told CNET that the company does not consider the information in the 404 Media story to be “materially new” since it has disclosed its training methods in a public filing and on its website.

“Suno’s music-generating AI models are trained on publicly available music files and associated metadata accessible from third-party websites on the open Internet,” their website says.

All of these cases support the turbulent nature of the art industry. Tech companies like Suno say they exist to help the creative process and democratize access; human artists in all languages ​​say AI use their work without permission to build cheap simulation known as AI slop used by managers laying off workers.

Some publishers and copyright holders have contracted with AI companies to use their content. AI companies are also introducing guardrails to prevent deepfakes and blatant copying — you can’t ask Suno to make a pop song in the style of Taylor Swift, for example.

But these measures did little to strengthen the musicians. Even when record labels strike deals with AI companies, as UMG did with Suno when they settled a separate lawsuit, artists say they haven’t received compensation for the use of their songs.