A hacker who breached the AI music generator in November 2025 handed 404 Media source code detailing how Suno allegedly ripped decades of audio from YouTube Music, Deezer, Genius, and podcast feeds — evidence that could bolster record labels' DMCA claims against the company.
Every AI training-data lawsuit runs into the same evidentiary wall: plaintiffs can hear that a model imitates copyrighted work, but they rarely get to see the scraping pipeline itself. That wall just cracked. A hacker who breached Suno in November 2025 shared source code with 404 Media that appears to document exactly how the AI music generator built its training library — pulling from YouTube Music, Deezer, Genius, the stock libraries Pond5, Jamendo, Freesound, IMSLP, and roughly a million hours of podcasts via RSS feeds, according to TechCrunch AI. Suno has long admitted to training on “publicly available music files” under a fair-use defense; what’s new is a paper trail suggesting the company also used proxy infrastructure to get around YouTube’s anti-scraping protections, which the major labels suing Suno say violates the DMCA.
The scraping ledger
The leaked files read like an inventory of the open internet’s music.
One file, described as source code from 2023 and 2024, lists the sources it will pull from — “genius_hq, youtube_music, freesound, jamendo, imp, deezer, ytm_tagged” — with a note that “non-music will be filtered out,” according to 404 Media. A file called youtube_music shows it had ingested “2,013,545 music clips” as of its last update. Another file breaks down dataset sizes by hour: “113,879 hours of youtube_music,” “17,615 hours of genius_hq,” “152,162 hours of ytm_tagged,” “62,117 hours of pond5_music,” and “12,287 hours of deezer,” among others — what 404 Media calls, in total, “at least decades worth of music.” The code also appears to hunt specifically for acapella versions of songs on YouTube, useful for isolating vocals, and used the scraping vendor Bright Data as a proxy layer, per the outlet’s review.
Not an isolated defendant
Suno is not the only AI music company with a YouTube problem.
Udio, its chief rival, admitted in an April 29 court filing reviewed by Music Business Worldwide that it “obtained audio data from YouTube for use as training data” and “acquired some of its training data by utilizing YT-DLP,” while calling the labels’ framing of that scraping as illegal circumvention “a gambit to try to evade application of the fair use doctrine.” Universal Music Group and Warner Music Group have already dropped their suits against Udio after reaching settlements, and Warner separately exited its case against Suno via a licensing deal, per Engadget — leaving Sony Music as the label still pressing the YouTube-circumvention theory against both companies. Google, YouTube’s parent, faces its own copyright allegations from book publishers, a reminder that the platform sits on both sides of the scraping economy: as an alleged victim of unauthorized extraction and, through its own AI training practices, as a defendant elsewhere.
The fair-use fight, sharpened
The RIAA’s argument has always been that scale matters.
“For Suno specifically, this process involved copying decades worth of the world’s most popular sound recordings and then ingesting those copies into Suno’s AI models so they can generate outputs that imitate the qualities of genuine human sound recordings,” the RIAA wrote in its filings, according to 404 Media. That argument gets easier to make with a hacked codebase showing dataset sizes in the tens of millions of clips, and it dovetails with reporting from The Atlantic, which in June 2026 identified datasets circulating in the AI-development community containing 12 million and 9 million tracks respectively — one of which would take 91 years to listen to in full, and both of which include the New Radicals’ “You Get What You Give,” a song The Atlantic traced to an AI-generated arena-rock cover performed at a figure-skating competition. Suno, for its part, told Engadget the breach “primarily involved outdated source code that is no longer in use at Suno and that no sensitive personal information was compromised,” and said it determined “individual notifications were not warranted under applicable privacy laws” despite the hacker also accessing customer emails, phone numbers, and partial Stripe card data.
What the ledger is worth
None of this settles the fair-use question in court, but it does something markets care about: it prices the risk.
If scraping YouTube at this scale is later found to violate the DMCA rather than merely copyright’s fair-use carve-out, every AI music generator built on similarly sourced audio — and every downstream licensing negotiation with labels — gets more expensive, not less. Watch what Sony does with its still-live suits against both Suno and Udio, whether other labels follow Warner and UMG toward settlement-driven licensing deals instead, and whether more hacks like this one keep turning scraping pipelines from trade secrets into courtroom exhibits.
For Suno specifically, this process involved copying decades worth of the world's most popular sound recordings and then ingesting those copies into Suno's AI models so they can generate outputs that imitate the qualities of genuine human sound recordings.
