A Hacker Reveals How Suno Secretly Harvested Music Data From YouTube

An attacker obtained Suno’s source code, an AI music generator, and discovered evidence of repeated attempts to bypass anti-scraping mechanisms. Based on their findings, Suno was scraping music data illegally from YouTube Music, Deezer, Genius, and podcast RSS feeds (“decades of audio”).

1What the Breached Code Revealed

In addition to the actual download scripts, Suno’s source code included functionality explicitly intended to bypass the anti-scraping mechanisms implemented by YouTube, Deezer, etc. This shows that Suno was scraping intentionally and systematically.

2User Data Breach

The attacker also obtained Suno user data, including email addresses, phone numbers, and partial credit card information. The breach took place in November 2025, but Suno did not notify any of its users at the time or since.

3Suno's Response and Context

Suno calls the breach “a limited security incident that was quickly contained”, which is a typical corporate euphemism for downplaying the severity of an event. The breach was only made public 8 months after it occurred.

Like many other large AI music generators, image generators, and text generators, Suno built its dataset by scraping as much as possible while nobody was looking, and then worrying about the legal and ethical implications afterwards. But as more cases like this come to light, there is increasing scrutiny on the industry to clean up its act.