Suno AI has been exposed for scraping millions of hours of copyrighted audio from YouTube, Deezer, Genius and other platforms.
Security researcher ellie.191 found the evidence inside Suno’s source code. The data includes songs, lyrics and podcasts collected from a wide range of online libraries. This discovery supports previous claims made by major record labels in a joint lawsuit filed in June 2024.
The legal action was brought by Universal Music Group, Sony Music Entertainment, Warner Music Group and the Recording Industry Association of America. They argued that Suno and its competitor Udio were carrying out copyright infringement on an unimaginable scale by ripping streams from YouTube.
The code
Screenshots shared by 404 Media show thousands, if not millions, of hours of music being ripped from millions of clips. One section of the code lists specific sources including genius_hq, youtube_music, freesound, jamendo, imp, deezer and ytm_tagged.
Other parts of the script indicate a search for vocal and acapella videos. These clips would help train models to filter vocals or generate entirely new AI voices. The leaked code also suggests one million hours of podcasts were downloaded.
According to the hacker, they uncovered the code by hacking an individual employee. They used the Shai-Hulud worm, a supply chain attack that allowed them to harvest GitHub and cloud service credentials. They also found they could access the payment information and personal data of hundreds of thousands of Suno users.
Despite having access to bank details, phone numbers and addresses, the hacker says they have no ill intentions. “I like to hack anything and everything,” they told 404 Media.
Artist reaction
The hacked code comes as another blow to artists speaking out against AI. SZA has been particularly vocal about her disapproval of the technology recently. She took to her private Instagram to condemn Diplo for his support of AI tools.
“If you’re a musician and you support this degenerate shit, you’re disgusting and there’s nothing you could ever say to me to make this okay,” she wrote.
What it means
For musicians and creators, this confirms the method used to train the models. The company previously insisted it was fair use to train its AI model on copyrighted songs. Now the code suggests the opposite. Users can expect more legal battles and a continued struggle over who owns the data used to build these tools.
