One of the loudest arguments in the generative AI era has been about what these systems were fed to make them work, and the music sector has become a flashpoint. Text-to-song tools such as Suno can spin out a passable pop track from a one-line prompt, but the major record labels have long insisted those results are only possible because the models ingested enormous quantities of copyrighted recordings without permission. Until now, much of that case has rested on inference. A fresh security incident may have handed the labels something closer to evidence.
According to International Business Times Australia, hacked source code attributed to Suno appears to reference the harvesting of audio from YouTube and the streaming service Deezer. If the material holds up to scrutiny, it undercuts the position AI music firms have generally taken in public, which is that their training practices are lawful and that they do not simply lift finished tracks. For the labels pursuing the company through the courts, an internal codebase that names specific platforms as data sources is far harder to wave away than an educated guess about what a model must have consumed.
How the fight got here
Suno, along with rival Udio, was sued in 2024 by the major labels through their industry body in the United States, which accused the startups of copyright infringement on a mass scale. The core complaint has always been about training data. Generative music models learn statistical patterns from vast libraries of existing audio, and the labels argue that copying those recordings to build a commercial product requires a licence, full stop. The AI companies have leaned on fair use and on the idea that their outputs are new works rather than copies, a line of defence that becomes considerably shakier if internal engineering notes describe pulling tracks straight off YouTube.
Scraping YouTube for audio raises a second problem beyond music copyright. It would also appear to cut across the platform’s own terms of service, which prohibit downloading content except through features Google itself provides. Deezer, for its part, has positioned itself as one of the more copyright-conscious streaming services and has built tools to flag AI-generated uploads, so any suggestion its catalogue was used to train a competing generator carries an obvious sting. Neither the breach nor the code has been independently verified in full, and Suno has strong incentives to contest both the authenticity and the interpretation of anything pulled from a hack, so the material should be treated as an allegation rather than a settled fact for now.
Two ways to read it
For the music industry, the leak is close to a smoking gun. Rights holders have spent two years arguing that AI firms built their products on the back of other people’s work and then declined to pay for it, and a codebase naming the sources fits that story neatly. It also strengthens the commercial case the labels would rather make, which is that AI music should run on licensed catalogues and revenue-sharing deals rather than on quietly scraped libraries. Several majors have signalled they are open to licensing if the terms are right, and evidence of unlicensed scraping gives them leverage to set those terms higher.
The counter-view, which the AI camp has pressed consistently, is that training a model on publicly accessible material is a transformative act closer to a human musician learning by listening than to piracy. Suno’s leadership, including chief executive Mikey Shulman, has framed the company as democratising music creation for people who cannot play an instrument, and its backers argue that locking up training data behind licences would entrench the incumbents who already own the catalogues. There is also a genuine legal question at the centre of all this. Courts in the United States have yet to deliver a clear ruling on whether training a commercial generative model on copyrighted works counts as fair use, and a hacked file, however damaging it looks, does not answer that question on its own.
What it means for Australia
The case is American, but the stakes are unmistakably local. Australia does not have a broad fair use provision in its copyright law. It relies instead on narrower fair dealing exceptions, which means an AI company operating here cannot lean on the same defence Suno is running in the United States. That gap has become a live policy fight, with the Productivity Commission floating the idea of a text and data mining exception to make Australia friendlier to AI development, and creative sector groups warning that such a change would legalise exactly the kind of scraping now alleged against Suno. FluentSea has covered the local dimension of that argument, including calls for the government to stand up to AI giants on copyright.
For Australian musicians, labels and the collecting society APRA AMCOS, the Suno leak is a useful data point in a debate that has often been abstract. It puts a concrete example behind the fear that local recordings uploaded to global platforms could be swept into training sets without consent or payment, and it strengthens the argument that any Australian reform should require licensing and provenance rather than a blanket carve-out. It also matters for the growing crop of Australian AI startups building on creative content, who will be watching how the courts treat scraped data. A finding against Suno would raise the compliance bar for everyone, including local firms hoping to license catalogues cleanly rather than hoover them up and hope for forgiveness.
What happens next
The immediate question is whether the leaked code makes its way into the labels’ litigation and, if so, how the courts weigh material obtained through a breach. Expect Suno to challenge its admissibility and its meaning, and expect the labels to argue it corroborates what they have alleged all along. Beyond the courtroom, the incident is likely to accelerate licensing conversations that were already underway, because both sides have reasons to prefer a negotiated framework over a precedent that boxes them in. For Australia, the more important timeline is the domestic one. The government’s response to the Productivity Commission’s copyright proposals will shape whether local creators get stronger protections or watch a scraping exception written into law, and a story like this makes the choice harder to duck.
Sources: International Business Times Australia.
