Suno code leak: hackers reveal data sources for training AI model
A high-profile security incident has revealed details of how the AI music service Suno collected data to train its models. A hacker under the pseudonym ellie.191, using the Shai-Hulud worm, infiltrated the company's systems through a compromised npm package. The malware stole credentials and access keys, after which the attacker gained access to the source code. Inside, logs of audio downloads from YouTube Music, Deezer, Pond5, and other platforms were discovered.
The volume of data is impressive: one file recorded the download of 2,013,545 music clips from YouTube Music with a total duration of 113,879 hours. Another set contained 152,162 hours of labeled recordings. The code also featured 62,117 hours from Pond5, 12,287 hours from Deezer, 17,615 hours from Genius HQ, and 19,514 hours from a library of musical scores. The plan included downloading about 1 million hours of podcasts from 420,000 RSS feeds, but the implementation of this stage remains in question.
Suno confirmed the incident, discovered in November 2025, but stated that it primarily affected legacy code and that sensitive user data was not compromised. However, the company has not published a technical report, raising doubts about the completeness of its statements. The hacker claims to have gained access to hundreds of thousands of records, including emails and phone numbers.
This leak is directly linked to lawsuits from major record labels. Universal Music Group and Sony Music Entertainment are demanding that 61,026 recordings found in Suno's training data using audio fingerprinting technology be added to the lawsuit. The labels claim that the service used tools like YT-DL to bypass YouTube's protections, which is a violation of the DMCA. The leaked code, demonstrating downloads from YouTube via proxies, could serve as substantial evidence in this dispute.
My analysis: This incident highlights a systemic problem in the AI music industry: the line between "fair use" and direct copyright infringement is becoming increasingly blurred. Suno will likely have to reconsider its data collection methods to avoid legal consequences. The partnership with Warner Music Group in November 2025, which included a licensing agreement, shows that the market is moving toward legalization, but the leak could accelerate this process for all players.