A Hack Leaked Suno's Source Code. It Lists Every Site the AI Scraped, by the Hour.

TL;DR

Suno, the AI music generator, has long said it trained on "publicly available" music and called it fair use. On July 15, 404 Media reported that a hacker breached the company and walked out with its source code, and that code spells out the scrape in receipts: a config that logs, by the hour, audio pulled from YouTube Music, Deezer, Genius, Pond5, and more. The break-in used the Shai-Hulud npm worm, the same supply-chain attack that tore through developer machines in late 2025. It also exposed data on hundreds of thousands of customers. If you build with AI, this is what your training-data provenance looks like when it stops being a black box.

What actually leaked

The prize was not user chat logs. It was Suno's own source code, dated 2023 to 2024, and the part that matters is a data-ingestion config that reads like a shopping list. One comment names the sources outright: genius_hq, youtube_music, freesound, jamendo, imp (the International Music Score Library Project), deezer, and ytm_tagged, with a dry note that "non-music will be filtered out."

Next to each source sits a running tally of hours ingested. YouTube Music alone shows 2,013,545 music clips. The per-source hour counts are the kind of number a company does not usually put in writing:

Podcasts got swept up too, pulled through raw RSS feeds. In court, Suno had already conceded it trained on "tens of millions of recordings" from the open internet. The difference now is that the abstraction has a manifest. There is a certain poetry in it: a company whose entire product is generating audio from other people's work had a complete inventory of what it copied generated for it, unprompted, by a worm named after a sandworm.

How it got out: a worm named Shai-Hulud

The entry point was not a clever exploit against Suno's servers. It was one developer's laptop. The hacker, who goes by ellie.191, told 404 Media they used the Shai-Hulud worm, a supply-chain attack that rode in through poisoned npm packages and harvested the victim's GitHub and cloud-service credentials. From there, the company's repositories were just open.

Picture it as one worker propping open the loading-dock door: the worm does not have to breach the front gate if a single trusted dependency lets it walk in through the back. Shai-Hulud's second wave hit in late November 2025, and it was not a boutique event. It compromised an estimated 600 to 800 npm packages and more than 25,000 GitHub repositories, spraying stolen tokens for AWS, Google Cloud, and Azure across the internet. Suno was one dot in that blast radius.

The customer data is the other half

Lost in the training-data headline is that this was also a plain old breach of user records. The hacker accessed a customer list covering hundreds of thousands of people, including email addresses, phone numbers, and Stripe payment information. Some customers told reporters they were never notified.

Suno's framing is that no full credit-card numbers live in its Stripe account, which is true and also not the point. Email plus phone plus "you paid a generative-music startup" is a tidy phishing kit on its own.

Why builders should care

This is not a music-industry sideshow. It is a preview of a risk sitting in every AI company's repo. Your training-data provenance is only a black box until the day it is not, and the thing that pries it open is rarely a subpoena. It is a leaked config file with honest variable names.

Two takeaways transfer directly to your stack. First, the attack vector was the dependency tree, not the model. If you pull npm, PyPI, or any package registry into a build that touches production credentials, Shai-Hulud is a live threat model, not a 2025 news item. Second, "we trained on public data" is a sentence that survives right up until someone can grep your ingestion pipeline. The gap between your public story and your source comments is now a discoverable liability.

There is a sharper legal edge here too. The labels suing Suno are not only arguing about fair use. They argue that scraping YouTube Music at all meant defeating its anti-bot protections, which they frame as a DMCA circumvention violation, a separate and harder-to-hand-wave claim than the copyright question. A config that logs 2 million clips pulled from YouTube is not a great exhibit for the defense. Warner Music, for its part, already settled with Suno and signed a licensing deal, which tells you which way at least one major read the wind.

Suno's response

The company calls it a "limited security incident that was quickly contained," says the exposed source code was "outdated" and no longer in use, and maintains that "no sensitive personal information was compromised." Take that at face value and it still does not un-scrape 113,879 hours of YouTube Music. Old code can be retired. The 2 million clips it already ingested are baked into a model that is very much in production.

Key Takeaways

• The manifest is real: leaked Suno source code logs scraped audio by source and by the hour, including 2,013,545 YouTube Music clips.
• Named sources: YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, IMSLP, and podcasts pulled via RSS, per the config comments.
• Supply-chain entry: the breach came through the Shai-Hulud npm worm harvesting one employee's GitHub and cloud credentials, not a server exploit.
• Users hit too: hundreds of thousands of customer emails, phone numbers, and Stripe payment records were exposed; some were never notified.
• Legal exposure grows: the leak feeds a DMCA-circumvention argument that is distinct from, and harder than, the fair-use fight.
• The builder lesson: your dependency tree is your attack surface, and your training-data story only holds until someone can read the code.

Sources: 404 Media, TechCrunch, Engadget, Palo Alto Unit 42