--- title: Suno AI scraped millions of YouTube songs for training... description: Leaked source code from a November 2025 breach of AI music generator Suno reveals the company scraped over 2 million YouTube clips, tens of thousands of hours... canonical: https://daily.dev/posts/suno-ai-scraped-millions-of-youtube-songs-for-training-data-according-to-leaked-source-code-tk6zahehg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Suno AI scraped millions of YouTube songs for training data, according to leaked source code | daily.dev og:description: Leaked source code from a November 2025 breach of AI music generator Suno reveals the company scraped over 2 million YouTube clips, tens of thousands of hours... og:url: https://daily.dev/posts/suno-ai-scraped-millions-of-youtube-songs-for-training-data-according-to-leaked-source-code-tk6zahehg og:image: https://api.daily.dev/og/posts/TK6ZaHeHg.png og:image:alt: Suno AI scraped millions of YouTube songs for training data, according to leaked source code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Suno AI scraped millions of YouTube songs for training data, according to leaked source code **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Leaked source code from a November 2025 breach of AI music generator Suno reveals the company scraped over 2 million YouTube clips, tens of thousands of hours from Deezer and Genius, 420,000 podcasts, and stock music library content to build its training dataset. The breach occurred via a supply chain attack using the Shai-Hulud worm, which compromised employee credentials. Beyond source code, attackers accessed customer emails, phone numbers, and partial Stripe payment records — yet Suno called it a 'limited security incident' and did not notify affected customers. The leaked code directly corroborates RIAA copyright lawsuit allegations that Suno stream-ripped audio from YouTube while bypassing copy protections, potentially violating the DMCA and YouTube's ToS. Suno maintains its training practices constitute fair use, a question still unresolved in court. ## Content ## What happened In November 2025, AI music startup Suno was breached through a supply chain attack. The Shai-Hulud worm — a credential-harvesting tool that spreads through npm packages and GitHub repositories — compromised a single employee's machine and pulled their GitHub and cloud credentials. From there, the attacker accessed source code, customer records, and Stripe payment data including partial credit card numbers. Suno confirmed the incident but called it a "limited security incident." The company did not notify affected customers. ## What the leaked code shows The more consequential part of the breach isn't the customer data — it's what the source code reveals about how Suno built its model. According to the leaked code, Suno scraped: - Over 2 million clips from YouTube - Tens of thousands of hours of audio from Deezer and Genius - 420,000 podcasts via RSS feeds - Stock music libraries The YouTube scraping is particularly significant. It appears to have bypassed YouTube's copy protections, which would violate both the DMCA and YouTube's terms of service. The RIAA had already alleged stream-ripping in its copyright lawsuit against Suno — the leaked code appears to confirm it. Suno has defended its training practices as fair use. That argument is still being tested in court. ## The broader legal context Suno isn't alone here. Competitor Udio faces similar allegations. Some music labels have started settling licensing deals with AI companies, but others — Sony among them — are waiting on a fair-use ruling that could reshape how the entire industry operates. The timing of this leak is awkward for Suno. It's one thing to argue fair use in the abstract; it's another when your own source code is circulating and showing exactly how the scraping worked. ## About Shai-Hulud The worm used in the attack has been active since at least September 2025, with multiple variants observed targeting developer toolchains. It spreads through compromised npm packages and GitHub repos, harvesting credentials from developer machines — the kind of access that can quietly open doors to much larger systems. Suno appears to be one of several companies hit. ## What's missing Suno hasn't said how many customers were affected or what it's doing to notify them. Given that the exposed data includes emails, phone numbers, and partial payment information, the silence is notable. --- Tags: [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/suno-ai-scraped-millions-of-youtube-songs-for-training-data-according-to-leaked-source-code-tk6zahehg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Suno AI scraped millions of YouTube songs for training data, according to leaked source code","url":"https://daily.dev/posts/suno-ai-scraped-millions-of-youtube-songs-for-training-data-according-to-leaked-source-code-tk6zahehg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/suno-ai-scraped-millions-of-youtube-songs-for-training-data-according-to-leaked-source-code-tk6zahehg"},"datePublished":"2026-07-15T22:19:16.027Z","dateModified":"2026-07-16T18:17:15.669Z","description":"Leaked source code from a November 2025 breach of AI music generator Suno reveals the company scraped over 2 million YouTube clips, tens of thousands of hours...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a7d79653738192ddd14bf870e4eb76a7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a7d79653738192ddd14bf870e4eb76a7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/suno-ai-scraped-millions-of-youtube-songs-for-training-data-according-to-leaked-source-code-tk6zahehg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Suno AI scraped millions of YouTube songs for training data, according to leaked source code"}]} ```