Hacked Suno Code Reveals Millions of Scraped Songs, Raising Copyright Questions

A trove of Suno AI’s source code, stolen by hacker ellie.191 and released to 404 Media, has exposed a massive catalog of copyrighted audio that the company allegedly harvested from major streaming and content‑distribution platforms between 2023 and 2024.

The leaked files contain explicit scripts that direct the Suno training pipeline to scrape YouTube Music, Deezer, Genius, the stock‑media marketplace Pond5, and other sites. They also outline a plan to gather podcast feeds via PodcastIndex and to target a cappella recordings. The most detailed of the files, a youtube_music script, records 2,013,545 individual clips that were ingested into Suno’s models. Dataset annotations in the same codebase assign 113,879 hours of content to YouTube Music, 62,117 hours to Pond5, 17,615 hours to Genius, and 12,287 hours to Deezer, with a separate plan to collect roughly one million podcast hours.

Suno has denied that the exposed code is in active use. The company says the code is outdated, that its current models are trained on publicly available internet files, and that no sensitive customer data was compromised during the November 2025 supply‑chain attack that gave the hacker access to the source code. Suno also maintains that the data in the leak does not prove that its models were trained on copyrighted material without permission.

The allegations arrive amid a lawsuit filed by the Recording Industry Association of America (RIAA). The RIAA’s complaint accuses Suno of “stream ripping” – capturing streamed media from YouTube in a way that bypasses the platform’s digital‑rights protections – and of circumventing technological measures designed to prevent unauthorized copying. The suit also claims that Suno used copyrighted music and lyrics to train its AI models without licensing. Suno’s defense has centered on the fair‑use doctrine, arguing that training a generative model does not substitute for the original recordings.

The legal dispute intensified after Suno settled a separate lawsuit with Warner Music Group (WMG) in November 2025. The settlement created a partnership that allows Suno to develop licensed AI models with WMG’s artists. Under the agreement, Suno will use opt‑in data from participating artists—including names, images, voices, and compositions—and will compensate them in future releases. Suno plans to roll out its first licensed model in the months following June 2026.

Industry observers note that the scale of the scraped material, if verified, could have significant implications for copyright enforcement. The RIAA’s claim that Suno engaged in stream ripping raises the question of whether the company’s data‑collection methods constitute a violation of the Digital Millennium Copyright Act’s anti‑circumvention provisions. Courts have not yet ruled on the facts, and independent authentication of the code is required before the allegations can be treated as evidence.

Suno’s recent funding round, which raised more than $400 million in June 2026, valued the company at $5.4 billion. The growth has drawn attention from both investors and regulators as AI‑generated music becomes more commercially viable. The partnership with WMG signals a shift toward licensed data usage, but the hacked code suggests that Suno’s earlier data‑collection practices may have relied on unlicensed content.

The leak also prompted criticism from artists. Musician Kenneth Blum, known as Kenny Beats, posted on X that he could not imagine working while “stealing from countless struggling musicians.” The comment highlights the tension between AI developers and creators over the use of copyrighted works.

At present, the legal status of the alleged scraped material remains unresolved. Suno has not provided independent verification of the code’s authenticity, and the RIAA’s claims have not yet been adjudicated. The company’s partnership with WMG and its upcoming licensed models may mitigate some legal risks, but the broader question of whether AI training on copyrighted content can be justified under fair use continues to be debated.

In summary, the leaked Suno code documents a large‑scale scraping operation that targeted major streaming and content‑distribution platforms. The allegations, if proven, could strengthen the RIAA’s case against Suno and influence how AI music companies approach data acquisition and licensing in the future.