A hacker broke into AI music platform Suno and walked out with source code that documents, in precise detail, exactly where the company's training data came from.
The intruder claims to have used a piece of malware called the Shai-Hulud worm—named after the enormous sandworms in Frank Herbert's Dune. Suno, one of the largest AI music generators online, lets users type a text description and receive a full song in seconds; building that capability required a substantial training dataset—a collection of audio files used to teach the model what different genres and styles sound like.
The leaked material consists of scraping instructions and internal logs from 2023 and 2024, offering a rare look at how those pipelines are actually assembled.
The dataset breakdown is specific. According to internal file comments reviewed by 404 Media, the training library included 113,879 hours of YouTube Music, 152,162 hours of tagged YouTube tracks, 62,117 hours from stock music library Pond5, 12,287 hours from Deezer, and 17,615 hours in a dataset labeled genius_hq, associated with material collected through Genius. The code also documented plans to download roughly 1 million hours of podcast audio via RSS feeds.
‼️ BREAKING: A hacker breached AI music company Suno using the Shai-Hulud worm and released source code showing how its training set was built:
One internal file tracking YouTube Music ingestion alone logged 2,013,545 music clips. That's millions of recordings covering decades of audio—and the appetite wasn't limited to music.
The hacker claimed to have accessed records associated with hundreds of thousands of customers, including emails, phone numbers, and Stripe-related information. Suno disputes that sensitive personal information was compromised.
The company says it identified the incident in November 2025 and called it "limited." Suno determined the exposure primarily involved outdated source code no longer in use and concluded that individual customer notifications weren't required under applicable privacy laws. Users are only finding that out now, through news coverage.
Suno did not immediately respond to a request for comment by Decrypt.
