Suno, the AI music generator, was reportedly breached, exposing internal references to a large-scale data collection operation involving music from YouTube Music, Deezer, Genius, and other sources.
404 Media reported that the exposed material came from a Suno company database. The files reportedly show that YouTube Music was one of the main sources used for the data connected to Suno’s AI training process.
One file titled youtube_music reportedly references more than two million scraped music clips. Other dataset records list 113,879 hours of youtube_music, along with 17,615 hours of genius_hq, 12,287 hours of Deezer, and 152,162 hours of ytm_tagged.
Taken together, those figures represent more than a decade of audio. The reported code also points to the use of third-party proxy services for collecting songs and other media. PodcastIndex, a service that catalogs podcast media files, was reportedly used to identify hundreds of thousands of podcasts that could be scraped.
Suno says the incident was contained
Suno had already acknowledged in legal proceedings that its models were trained on “essentially all music files of reasonable quality that are accessible on the open internet,” as 404 Media previously reported.
The company has argued that training on copyrighted material can fall under fair-use protections. The RIAA has separately accused Suno of unlawfully scraping tracks from YouTube, among other allegations, in an update on the dispute.
A Suno spokesperson told 404 Media that the company’s models were trained on “publicly available music files and related metadata accessible on third-party websites on the open internet.”
The spokesperson also said Suno identified a “limited security incident” in November 2025, contained it quickly, and found that it mainly involved outdated source code that was no longer in use. Suno said its investigation found no compromise of sensitive personal information. That statement appears in the report on the breach.
The legal fight over AI training data continues
Suno maintains that its generated songs differ meaningfully from the original works used in training. The company also says it has protections against impersonation and other misuse, along with systems intended to identify AI-generated music.
The broader legal picture remains unsettled. A U.S. judge ruled in June 2025 that Anthropic’s use of copyrighted works to train its AI models qualified as fair use, while still rejecting the use of pirated books in that process. Meta later won a case involving claims that it trained AI tools on books from 13 authors without permission, according to Wired’s account of the ruling.
Those decisions do not settle the questions surrounding Suno’s reported collection methods. The music industry has continued to voice concern about AI-generated songs and the use of recorded music in training datasets. Artist representatives have also raised concerns that mass-produced AI tracks could reduce royalty pools for human musicians, as reported by Music Business Worldwide.
For now, the reported breach adds another layer to the dispute. It does not by itself establish how every file was obtained or whether each collection method broke the law, but the disclosed figures offer a rare look at the scale of the material tied to Suno’s training data.
What do you think about the use of recorded music to train AI generators? Share your thoughts in the comments, and follow us on X, Bluesky, YouTube, and Instagram.
