Hacking of Suno matters because it appears to expose something that generative-AI companies have usually kept hidden: the operational machinery used to assemble a commercial training corpus.

2025-11-28 · Source: Pascal’s Substack · Field: Legal & Regulatory — Intellectual Property & Patents, Compliance & Risk Management, Legal Technology (LegalTech) · Depth: Intermediate, long

Summary

A reported hack exposed Suno's source code, revealing systematic scraping of millions of recordings, lyrics, and audio from platforms like YouTube, Deezer, Genius, and Pond5 to build its AI training datasets. The leaked material, if authenticated, details an organized acquisition program, including over two million YouTube Music clips, 113,879 hours of YouTube Music, 152,162 hours of a separate YouTube dataset, 62,117 hours of Pond5 music, 19,514 hours of IMSLP material, 17,615 hours from Genius, 12,287 hours from Deezer, and 3,726 hours from Jamendo. This leak shifts the legal focus from fair use of copyrighted music to the legality of obtaining these copies, potentially strengthening rights owners' claims regarding stream ripping, access-control circumvention, and DMCA violations, accelerating settlements, and possibly forcing Suno to transition to licensed, auditable training systems.

Key takeaway

For Directors of AI/ML evaluating training data strategies, this incident underscores the critical importance of auditable and legally sound data acquisition. Your teams must prioritize transparent provenance and explicit licensing for all training materials, especially when sourcing from "publicly available" platforms. Failing to establish a lawful upstream supply chain, even if downstream model use is deemed transformative, exposes your organization to significant legal risks, including DMCA claims and substantial damages. Proactively review your data sourcing policies and internal legal advice.

Key insights

A generative AI company's training data acquisition methods are now a critical legal battleground, not just fair use.

Principles

• Public accessibility does not imply permission for commercial AI training.
• Lawful downstream use does not excuse unlawful upstream data acquisition.
• Circumventing access controls can incur separate DMCA liability.

Method

The article describes Suno's alleged method of using YouTube-specific acquisition scripts, proxy infrastructure, and targeted searches for a cappella versions to extract audio.

In practice

• Scrutinize AI training data provenance and acquisition methods.
• Implement robust legal reviews for data sourcing and licensing.
• Prepare for increased discovery requests regarding data supply chains.

Topics

• AI Training Data
• Copyright Law
• DMCA Section 1201
• Generative AI
• Data Scraping
• Fair Use Defense
• Music Licensing

Best for: CTO, Executive, VP of Engineering/Data, Legal Professional, Director of AI/ML, Investor

Related on AIssential

• Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius — Suno's training data, exposed by a hack, confirms extensive scraping of copyrighted music from major online platforms.
• The Atlantic created a searchable database of the music used to train AI — AI music models are trained on vast, publicly available datasets, often acquired through methods that violate platform terms of service.
• Hachette v. Google: one of the first complaints constructed to remain dangerous even if a court concludes that model training can sometimes be fair use. — Copyright lawsuits against AI models are strengthened by separating unlawful data acquisition from model training.
• The complaint is trying to turn a messy cultural argument (“training vs theft”) into a narrower systems argument: “you weren’t allowed to take the files, and you had to bypass controls to do it.” — The lawsuit against NVIDIA redefines AI training data acquisition as DMCA circumvention, not just copyright infringement.
• Microsoft built supercomputer to help OpenAI infringe copyrights, NYT alleged — New legal precedent requires plaintiffs to prove intentional inducement for contributory copyright infringement in AI training cases.
• Porn, dog poo and social media snaps: the ‘taskers’ scraping the internet for AI firm part-owned by Meta — AI training relies on a vast gig workforce performing ethically questionable data collection from public and private sources.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Pascal’s Substack.