Source Code Hack Reveals Suno AI Trained on Millions of YouTube Songs, Validating Record Label Lawsuits

In a digital folder simply titled "youtube_music," there sat exactly 2,013,545 audio clips. It wasn't a teenager's meticulously curated playlist, nor was it a DJ's archival library. It was a foundational building block for one of the most popular artificial intelligence tools on the internet. For months, the music industry has suspected that generative AI companies were feeding their models a steady diet of copyrighted hits, transforming the life's work of human artists into synthetic, on-demand audio. Now, a massive data breach at the AI music startup Suno has pulled back the curtain, transforming those industry suspicions into hard, verifiable data.[1][2]

The breach, executed by a hacker using the pseudonym "ellie.191," targeted Suno through a sophisticated supply chain attack in late 2025. By compromising an employee's credentials via a vulnerability known as the Shai-Hulud worm, the hacker extracted internal source code from 2023 and 2024 and shared it with the tech publication 404 Media. This leak provides a rare, unfiltered look into the "black box" of AI training—the closely guarded proprietary processes that tech companies use to teach their algorithms how to mimic human creativity. It represents one of the first times the public has seen the exact instructions an AI company used to vacuum up the internet.[1][2][3]

The leaked code reads like a grocery list of the internet's audio archives—if the shopper were systematically clearing out every aisle without paying. Beyond the two million individual YouTube clips, the files detail the ingestion of 113,879 hours of audio from YouTube Music, 17,615 hours of lyrics and music from Genius, and 12,287 hours from the streaming service Deezer. The scraping instructions didn't stop at pop music. They targeted stock music libraries like Pond5 and Jamendo, classical archives like the International Music Score Library Project, and hundreds of thousands of podcasts pulled directly from public RSS feeds.[1][5]

This revelation arrives at a critical juncture for the creative economy. Suno, which allows users to generate full, polished songs complete with vocals and instrumentation from simple text prompts, is currently facing an existential legal threat. In June 2024, the Recording Industry Association of America (RIAA) coordinated a massive copyright infringement lawsuit against the company. Representing heavyweights like Universal Music Group, Sony Music Entertainment, and Warner Records, the RIAA alleged that Suno built its highly profitable product by exploiting the recorded works of artists ranging from Chuck Berry to Mariah Carey without permission or compensation.[4][5]

Crucially, the leaked source code appears to validate a specific, highly technical claim in the RIAA's lawsuit: that Suno engaged in "stream-ripping." The labels allege that the AI company didn't just listen to publicly available music, but actively circumvented YouTube's "rolling cipher" encryption. This encryption is a technological measure specifically designed by the platform to prevent unauthorized downloading and copying. If proven in court, bypassing these access controls could violate the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA)—a legal hurdle that sits entirely apart from the broader, murkier debate over copyright and fair use.[5][6]

For its part, Suno has never explicitly denied training its models on copyrighted material. In previous court filings responding to the RIAA, the company admitted to using "essentially all music files of reasonable quality that are accessible on the open internet," which it estimated at tens of millions of recordings. Suno's legal defense hinges entirely on the concept of "fair use." The company argues that its AI models are not memorizing and regurgitating pre-existing content to serve as a substitute for the originals. Instead, they claim the AI is analyzing the underlying mathematical patterns of music to generate completely new, original outputs—much like a human musician learning to play the guitar by listening to the radio.[3][4]

The fallout from the hack extends beyond intellectual property and into the realm of consumer privacy. The hacker claimed to have accessed sensitive customer records for hundreds of thousands of users, including emails, phone numbers, and partial payment details kept by Suno's payment vendor, Stripe. Following the publication of the leak, a Suno spokesperson confirmed the security incident but downplayed its severity. The company stated that the breach primarily involved outdated source code that is no longer in active use, and vehemently denied that sensitive personal information requiring legal notification was compromised. They maintained that full credit card numbers were never exposed.[1][2]

Regardless of the data privacy dispute, the leak has fundamentally altered the landscape of the AI copyright wars. For years, AI developers have hidden behind the abstraction of "machine learning," treating their training datasets as proprietary trade secrets. By exposing the exact mechanisms, file names, and scale of data scraping, the Suno hack strips away that abstraction. It leaves a concrete trail of code that courts, lawmakers, and the public can finally examine, setting the stage for a legal showdown that will determine the future of music creation.[1][5]