A major breach at AI music startup Suno has pulled back the curtain on just how these systems are trained — with leaked source code and logs detailing the exact piles of audio the company fed its models. The files, first reviewed by 404 Media after a hacker claimed to have used a malware called the “Shai‑Hulud” worm, give an unusually granular look at Suno’s ingestion pipeline from 2023–2024 and confirm many of the industry’s suspicions about where training data came from.
What the leak shows
- The leaked code contains scraping instructions and internal logs that itemize the training library with striking specificity:
- 113,879 hours of YouTube Music
- 152,162 hours of tagged YouTube tracks
- 62,117 hours from stock music library Pond5
- 12,287 hours from Deezer
- 17,615 hours in a “genius_hq” dataset tied to Genius-sourced material
- Plans to harvest roughly 1 million hours of podcast audio via RSS feeds
- One ingestion log for YouTube Music alone lists 2,013,545 music clips — millions of recordings spanning decades.
- The hacker also claimed to have lifted customer records (emails, phone numbers, Stripe details). Suno disputes that any sensitive personal information was exposed and says the incident — first identified in November 2025 — involved primarily outdated source code no longer in use.
Why this matters
- The leak supplies the specificity missing from earlier disclosures. Under California’s AB 2013, Suno had acknowledged publicly that its training corpus likely included music “subject to intellectual property protection,” describing it only in broad terms (tens of millions of publicly available audio files). The hacked materials move beyond vague legal language into concrete evidence of sources and scale.
- The data corroborates allegations from the music industry. The RIAA amended a 2024 lawsuit in 2025 alleging Suno scraped songs directly from YouTube — a claim Suno has contested under fair use. The suit seeks statutory damages of $150,000 per infringement. The hacked code bolsters the RIAA’s central contention.
Legal and industry context
- The Atlantic and other outlets had already made large-scale music training sets visible earlier in 2026, publishing searchable databases containing millions of tracks. The industry’s legal fight over AI-trained music has been intensifying since 2024.
- Parallel litigation and settlements are reshaping the space: Udio, another target of the major-label coalition, settled with Warner Music in November 2025 and is shifting toward a licensed model. Suno’s disputes with Sony and UMG remain active in federal court.
- Suno’s market position amplifies the stakes: the company is valued at about $5.4 billion and claims roughly 100 million users.
Suno’s response and next steps
- Suno told regulators it identified the breach in November 2025 and labeled it “limited.” The company says the exposed code was largely historic and not in active use, and that individual customer notifications were not required under applicable privacy laws. News organizations are only now reporting the leaked details publicly.
- Suno did not immediately respond to a request for comment from Decrypt.
Why crypto and web3 audiences should care
- The fallout from this leak will influence how creative works are licensed, how rights are tracked, and how provenance is proved — issues central to tokenized music rights, NFTs, and decentralized content platforms. As traditional and AI-driven music services wrestle with IP exposure and litigation risk, expect renewed interest in licensed, on‑chain rights solutions and platforms that can verifiably manage usage and royalties.
Bottom line: the Suno leak is a rare, detailed snapshot of an AI music model’s diet. It underscores how large-scale scraping of commercial and user content has become a foundation for generative audio — and it raises fresh legal, privacy and business-model questions that will ripple across the music, AI and crypto ecosystems.
Read more AI-generated news on: undefined/news
