A Hack Revealed What an AI Music Generator Was Trained On, and It's Two Million YouTube Clips
Leaked source code from AI music company Suno lists YouTube Music, Deezer and Genius among its training sources, with over two million music clips logged. It arrives while the company is being sued by two major labels.
One of the hardest questions to answer about any AI system is a simple one: what was it trained on? Companies rarely say. In the case of the AI music generator Suno, a security breach answered it for them.
According to reporting by 404 Media, a hacker obtained Suno’s source code, and the internal files list the sources the company drew on to build its models. The names include YouTube Music, the streaming service Deezer, and the lyrics site Genius, along with stock music libraries such as Pond5, Jamendo and Freesound, the sheet-music archive IMSLP, and podcasts pulled through RSS feeds. The scale is logged in the files themselves. One dataset labelled “youtube_music” records 2,013,545 music clips ingested, amounting to roughly 113,879 hours of audio, with a further 152,162 hours in a tagged version. Pond5 accounts for about 62,117 hours, Genius for 17,615, Deezer for 12,287.
The breach also exposed customer data. The same hacker accessed records for hundreds of thousands of Suno users, including email addresses, phone numbers, and Stripe payment details, and some affected customers told 404 Media they had never been notified. Reporting traces the original intrusion back to a compromised employee credential from late 2025, taken by a piece of malware that harvests developer logins.
What is behind it: the timing matters, because Suno is currently defending itself against Universal Music Group and Sony Music Entertainment in a copyright case coordinated by the RIAA. Suno’s argument is that training on copyrighted works counts as fair use, a legal doctrine that permits certain uses of protected material without permission. That argument does not depend on hiding the sources, but the labels have alleged specifically that Suno took songs straight from YouTube, and internal files listing two million YouTube clips are considerably more concrete than an inference. In plain terms: a question that lawyers would normally spend months fighting over in discovery got answered by a leak instead.
This is a pattern worth noticing rather than a one-off. Across text, images and now music, the “what was this trained on” question keeps getting answered from the outside, through lawsuits, court-ordered disclosure, and occasionally breaches. The industry practice of collecting first and settling the legal questions later is meeting steady resistance.
What this means for you: if you use AI music tools casually, nothing breaks today, but be aware that the legal ground under generative music is genuinely unsettled, and a ruling against Suno could change what these services are allowed to do. If you are a musician or a creator, this is the clearest public evidence yet of how your work may have travelled into a training set. And if you had a Suno account, treat it as breached: change the password, change it anywhere you reused it, and keep an eye on the card you paid with. That advice holds regardless of how the copyright case ends.
Sources
Source: https://www.404media.co/hack-reveals-suno-ai-music-generator-scraped-youtube-deezer-and-genius/
A Toyota Spin-Off Built a Humanoid Robot With No Legs, and It's Already Working Shifts
Walden Robotics came out of stealth with around $300 million at a $1.1 billion valuation. Its robot rolls on wheels instead of walking, and one is already doing eight-hour shifts in a Toyota plant.
