Newly reported evidence from a security breach at Suno, one of the leading AI tools for generating music, suggests the company built its models by scraping millions of copyrighted songs from across the internet without permission.
Suno lets users create original-sounding songs from short text prompts. According to reporting by TechCrunch, source code obtained in a hack of the company points to training data pulled from YouTube, the streaming service Deezer, the lyrics site Genius, podcast feeds and stock-music libraries. The material was shared with the investigative outlet 404 Media, which detailed the findings.
What the breach revealed
The intrusion, reported to have occurred in late 2025 using stolen employee credentials, exposed internal code that, the outlets say, shows how Suno gathered audio at scale, including by taking tracks from YouTube in a way that would sidestep the platform's protections against downloading. The same breach is also said to have exposed some customer data.
These are, at this stage, findings drawn from leaked material and reporting rather than facts established in court, and they describe what the code appears to show. Still, they offer an unusually direct look at the training practices of an AI company, details firms in the sector typically keep tightly held.
Suno's position
Suno has defended its approach in general terms, arguing that it trains on music that is publicly available online and that using such material to build an AI model is a "transformative" use protected under copyright law, a defense the wider industry has leaned on heavily.
A widening legal fight
The company was already being sued by the major record labels, Universal Music Group, Sony Music and Warner Music, which accuse it of large-scale copyright infringement and of circumventing technical protections in violation of US law. Suno's rival Udio faces similar claims. Rights holders argue that training AI on unlicensed songs undermines artists' livelihoods and their control over their work; AI developers counter that access to large amounts of data is essential and that their use is lawful.
The leaked code could hand the labels concrete technical detail to bolster their case, potentially helping them argue that any scraping was deliberate rather than incidental. More broadly, the episode adds to a series of disputes, spanning music, books, news and images, over whether AI companies must pay for the copyrighted material that powers their systems. The Suno case, now sharpened by the hack, is shaping up as an important test of where the line falls.
