Musicians, streaming services and record labels have been claiming for years that AI music services use their vast collections of human-created music to build their artificial intelligence tools. Now we have a clearer picture of how Suno, an AI company that helps people create AI audio clips and songs, created its music.
A hack of Suno's source code reveals that it trained its AI by scraping massive amounts of music and lyrics from platforms like YouTube Music, Deezer, Genius and stock music libraries, 404 Media reported Wednesday.
The hacker, who goes by the moniker ellie.191, used a supply chain attack vector in November 2025. Screenshots and information shared with 404 Media confirm some of the origins of the company's training data from 2023 and 2024.
One file shows that, at the time it was last opened, there were over 2 million clips in a folder called "youtube_music." Other files contain over 17,000 hours of music from Genius HQ, more than 12,000 hours from streaming service Deezer and more than 62,000 hours from a Shutterstock-owned stock music site called Pond5. The hacker was also able to access customer records and payment details kept by Suno's payment vendor, Stripe, 404 Media reports.
A Suno spokesperson told CNET that the company immediately investigated the breach and found it "primarily involved outdated source code that is no longer in use at Suno and that no sensitive personal information was compromised." The company also denies it has access to customers' full credit card numbers and concluded that, under current privacy laws, it did not need to notify individual users.
Pulling back the curtain on AI-generated music #
With a new trend of people creating songs from their text message exchanges, you may have heard of some of Suno's AI-generated songs on social media. As sites like Suno gain popularity, it's important to know how they operate.
Even though the source code shown in the hack isn't in use anymore, it's a unique peek into the black boxes tech companies guard as they build generative AI. It also seemingly validates many of the allegations in the copyright infringement lawsuits brought against Suno.
A trade association representing the biggest record labels, including Universal Music Group, Sony Music Entertainment and Warner Music Group, claims in an ongoing lawsuit that Suno's use of its artists' songs, without consent or proper licensing, violates their copyright protections.
Like other AI companies, Suno is claiming its use of original material as training data is legal under the fair use doctrine in copyright law. Anthropic and Meta won similar lawsuits brought by authors claiming infringement last summer.
A source close to the litigation told CNET that the company doesn't consider the information in 404 Media's story "materially new" since it has disclosed its training methods in a public filing and on a page on its website.
"Suno's music generative AI models are trained on publicly available music files and related metadata accessible on third-party websites on the open internet," its website says.
All these lawsuits underpin the tumultuous situation unfolding in creative industries. Tech companies like Suno say they are there to aid the creative process and democratize access; human artists across all mediums say AI uses their work without permission to create cheap imitations known as AI slop that executives use to lay off workers.
Some publishers and copyright holders have struck deals with AI companies to use their content. AI companies have also introduced some guardrails to prevent deepfakes and explicit copying -- you can't ask Suno to create a pop song in the style of Taylor Swift, for example.
But these measures have done little to reassure artists. Even when record labels strike deals with AI companies, as UMG did with Suno in settling a separate lawsuit, musicians say they haven't received any compensation for the use of their songs.