Internal source code obtained from a breach of Suno confirms that the AI music generation platform scraped audio directly from YouTube Music, Deezer and Genius, as well as from paid stock libraries including Pond5, to build its training model. The data was shared with 404 Media by a hacker who accessed the company's systems.
The confirmation matters because it turns an allegation into a documented fact. The Recording Industry Association of America had accused Suno of stream-ripping songs from YouTube as part of its 2024 lawsuit against the company, a legal battle that has significant implications for the wider music industry. The hacked source code, which appears to date from 2023 and 2024, shows scraping scripts and dataset volumes that validate that claim directly. The files suggest Suno ingested over 100,000 hours of YouTube Music alone. In separate legal proceedings, Suno had already acknowledged training on “essentially all music files of reasonable quality accessible on the open internet,” but the breach reveals the specific platforms and the scale involved.
The inclusion of Pond5 is a detail that will concern independent artists specifically. Pond5 is a stock music library owned by Shutterstock where producers license their work commercially, meaning artists who uploaded music through proper licensing channels may have had that same music scraped for AI training without consent or compensation. This follows some starking revelations made by The Atlantic’s AI watchdog: an investigation published last month revealed that over 21 million tracks from artists including Flume, Tame Impala and Sia were used to train AI models without permission.
Suno confirmed in a statement that a security incident occurred in November 2025, describing it as “quickly contained” and involving “outdated source code no longer in use.” The company said it did not believe individual customer notifications were required under applicable privacy law. Suno has argued in its ongoing legal cases that training on copyrighted material constitutes fair use.
Suno CEO Mikey Shulman said in a podcast interview last year that he believes the majority of people do not enjoy the majority of the time they spend making music, a comment that drew sustained criticism from the production community and sits uncomfortably alongside a platform built on their work.
For the dance music production community, the disclosure closes a significant gap in the public record. AI-generated content now contributes to the 120,000 tracks entering streaming platforms daily, compressing the visibility window for every human release. The Suno data confirms that the model was built directly on the work of the artists it now competes against in the same algorithmic feed.
Despite ongoing litigation, a settled lawsuit, confirmed scraping of licensed platforms and a data breach affecting hundreds of thousands of users, Suno continues to operate freely with no regulatory intervention.
Jason Koebler reported the original investigation at 404 Media. The full piece is at 404media.co.
TOMORA: A World Beyond Their Own
12 Summer Dance Anthems That Still Sound Incredible Today
