Suno Hack Exposes Massive Scraping of Streaming Platforms for AI Training

A security breach at AI‑music platform Suno has exposed how the company built its training data by harvesting content from major streaming and lyric sites. The leak, first reported by 404 Media and later covered by Variety, Digital Music News and TechCrunch, shows that Suno’s code referenced more than 113,000 hours of YouTube Music, 152,000 hours of tagged YouTube audio, over 17,000 hours of Genius data and more than 12,000 hours from Deezer.

The exposed code also lists a variety of other repositories that fed the model: Pond5, Jamendo, Freesound, the International Music Score Library Project (IMSLP) and podcast RSS feeds. One section reveals that the company searched YouTube for a cappella versions of songs, presumably to isolate vocal tracks for training.

Suno’s spokesperson quickly addressed the leak. "The code in question is outdated source code that is no longer in use at Suno," the company told 404 Media. It added that no payment or credit‑card data was compromised and that its AI models were trained on publicly available music files and related metadata.

The revelations arrive amid a flurry of lawsuits from major record labels and the Recording Industry Association of America (RIAA). Universal Music Group and Sony Music Entertainment have sued Suno, accusing the platform of copying copyrighted recordings without permission to train its AI systems. A key point in the litigation is the allegation that Suno engaged in "stream ripping"—downloading protected audio from YouTube while bypassing the platform’s technical safeguards. The leaked source code appears to corroborate the claim that Suno scraped YouTube recordings, a fact that could undermine the company’s fair‑use defense.

Suno has been sued by the RIAA for copyright infringement and has previously acknowledged in court filings that its models were trained on music available across the open internet. The current leak provides the most detailed public view yet of how a major AI‑music generator may have assembled its datasets.

For independent artists, the incident underscores the growing debate over the use of copyrighted work in AI training. Many creators support AI as a creative tool but insist that copyrighted music should be used only with permission, transparency and fair compensation. The Suno case is likely to influence how future AI music models are built and licensed, as the industry watches how courts interpret the balance between fair use and the need to protect intellectual property.

The breach also highlights the broader trend of data scraping in the AI music sector. Suno’s partnership with Microsoft and its inclusion in Microsoft Copilot had raised expectations about the quality and legality of its training data. The current breach shows that even large, well‑connected companies can rely on large‑scale scraping of public platforms to fuel generative models.

Legal and regulatory implications are still unfolding. While Suno claims the code is no longer in use, the fact that it existed and was used to collect massive amounts of copyrighted content may strengthen the record labels’ cases. The outcome of the ongoing lawsuits will likely set precedents for how AI music companies must source and license data.

In the meantime, Suno has stated that the breach was contained and that no sensitive payment information was exposed. The company’s spokesperson emphasized that the code was outdated and that the platform’s current training processes do not involve the same scraping methods.

The Suno hack confirms that large AI music generators can and do scrape content from major streaming and lyric sites. The incident is a reminder that the legal framework surrounding AI training data is still evolving, and that artists, labels and platforms must navigate a complex landscape of copyright, licensing and fair‑use considerations.

The case remains in court, and the next major development will likely come from the outcome of the lawsuits filed by Universal, Sony and the RIAA. Until then, the industry will continue to monitor how Suno and other AI music platforms respond to the legal challenges and how they adapt their data‑collection practices.