The most popular music AI was trained on millions of stolen tracks—what a surprise!

Music-generating AIs, like LLMs, feed on data, and nobody really overlooks where the fuel comes from. Suno, one of the sector’s most prominent platforms, has been facing lawsuits from the major record labels since 2024, accusing it of pillaging their catalogs to feed its model.The company is defending itself by invoking fair use, the U.S. legal principle that tolerates certain uses of copyrighted works and has been invoked many times by AI giants to defend themselves against accusations of intellectual property theft. A hack has just seriously complicated its line of defense: the stolen source code details, platform by platform, the scale of the scraping operation.

A music vacuum plugged into YouTube and Deezer

The exfiltrated code, dating from 2023 and 2024, reads like an inventory of carefully labeled training libraries. A single library, named “youtube_music,” lists more than two million clips, amounting to tens of thousands of hours of music. The rest draws from Deezer, Genius (whose lyrics, need we remind you, are copyright-protected texts just like a song), the Pond5 and Jamendo sound libraries, and even some 420,000 harvested podcasts totaling nearly one million hours of audio. Nothing here resembles a random collection; it is entirely methodical, organized ingestion.

The technical method used says a lot about the deliberate nature of the operation. To get past YouTube’s anti-scraping protections, the code routed its requests through a commercial proxy-server infrastructure, Bright Data, which makes it possible to rotate IP addresses continuously (much like a motorist who, to avoid the toll, would take a thousand different back roads). Some routines even specifically searched for a cappella versions of tracks, in order to obtain clean, clear vocals.None of this is really a surprise: in court, Suno has already admitted to having trained on “practically all publicly available music files of decent quality”, as well as on tens of millions of recordings. The leak simply turns that vague admission into a precise breakdown, platform by platform, hour by hour.

July 31: a ruling that matters for all AI

A highly anticipated ruling is due in Munich on July 31 in the case pitting Suno against the German rights-management company GEMA (the local Sacem, in other words). The chamber handling the case is no ordinary chamber: it is the same one, with the same judge, that convicted OpenAI in November 2025 for the use of song lyrics. A victory for GEMA would be the first European ruling confirming that training a music AI requires a license. Under German law, it could be enforced immediately, even if the decision were appealed, potentially resulting in an injunction against Suno’s European activities.

Read also: Three publishers, including Hachette, accuse Google Gemini of plundering millions of books

The relay server case adds another layer to the case. Circumventing technological protection is illegal in itself in the United States, regardless of the fair-use debate. Even if Suno ultimately persuades a court that the training constitutes transformative use, the issue of circumvention would remain on the table. The US trial, meanwhile, has been postponed until April 2027.Against a backdrop of a French market worth €1.03 billion, with 17.7 million streaming subscribers, and creators closely watching the battle. For European users of Suno, the breach also brings a second piece of bad news: it has also exposed customer data (email addresses, phone numbers, fragments of bank card numbers) from a November 2025 intrusion, which the company never warned those affected about.

Suno CEO Mikey Shulman recently said that most people don’t really enjoy the time they spend making music. Artists whose works were used to train its model will appreciate the phrasing. Whatever the Munich court decides, its ruling will set a benchmark for every generative AI that has ever accessed a protected file. And for the hobbyists who were quietly composing their hits on the app, a reminder is warranted: their data, too, was included in the leak.

👉🏻 Follow tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.

Source: 404 Media