Suno's AI Wormed Its Way Through Sandworm Source Code 🍝

A hacker breached AI music platform Suno and exfiltrated internal source code documenting the precise composition of the company's training dataset, 404 Media reported, citing leaked files reviewed by the outlet. The intruder claimed to have used a worm called Shai-Hulud, a reference to the sandworms of Frank Herbert's Dune.

According to internal file comments reviewed by 404 Media, Suno's training library contained 113,879 hours of YouTube Music, 152,162 hours of tagged YouTube tracks, 62,117 hours from stock music library Pond5, 12,287 hours from Deezer, and 17,615 hours in a dataset labeled genius_hq associated with material collected through Genius. The leaked code also documented plans to download roughly 1 million hours of podcast audio via RSS feeds. One internal file tracking YouTube Music ingestion alone logged 2,013,545 music clips.

The hacker claimed to have accessed records associated with hundreds of thousands of customers, including emails, phone numbers, and Stripe-related information. Suno disputes that sensitive personal information was compromised. The company says it identified the incident in November 2025 and characterized it as "limited," determining that the exposure primarily involved outdated source code no longer in use and that individual customer notifications weren't required under applicable privacy laws.

Suno had previously disclosed under California's AB 2013 law that its training data may include music "subject to intellectual property protection," describing the corpus as tens of millions of publicly available music audio files. The leaked code, by contrast, provides hour-level granularity by source and platform.