SHELFCRITTER AI Digest

COMPANY

Suno

companytopic-notegenerative-audio

Overview

Suno is a US generative-audio AI company producing music-generation models trained on public-web audio corpora. The company entered the corpus on 2026-07-17 as the subject of a supply-chain compromise (reportedly traced to the Shai-Hulud npm worm) that exposed Suno source code and dataset manifests at a granularity discovery motions had not previously reached — establishing the first source-code-level provenance disclosure for generative audio. UMG partially settled with Suno in October 2025; Sony and residual UMG claims remain active in D. Mass. before Judge Saylor.

Timeline

  • 2026-07-22-AI-Digest — A cyberattack on Suno leaked personal information of more than 55.3M users, per the Have I Been Pwned listing that surfaced today. Records include emails, phone numbers, addresses, and partial Stripe card data; per HIBP metadata the breach dates to November 2025, and leaked source code reveals prior scraping of Deezer, Genius, and YouTube. The disclosure gap is worth naming: Suno has not publicly confirmed the breach or notified users — the record count is HIBP’s, not Suno’s, and the discovery-to-disclosure lag is roughly eight months. Narrow read: the scale places it among the larger AI-SaaS breaches to date, and the leaked source revealing multi-platform scraping is a copyright-risk vector on top of the user-data one — extends the 2026-07-17-AI-Digest source-code-level provenance thread from what corpus data was ingested to what user data was retained. Structural read the corpus carries: Suno is a generative-AI startup that took in millions of user prompts, uploads, and account data as its core corpus — exactly the shape of vendor the “AI SaaS is now a high-value breach target” thread has been warning about. The HIBP-first disclosure pattern (breach detected by external researcher, not vendor) is the failure mode; audit AI-vendor incident-response commitments before piping user content in. 30-day watch: whether Suno issues a formal disclosure, and whether an amended discovery motion in the Sony case cites the leaked user records alongside the Jul 17 dataset manifests.
  • 2026-07-17-AI-Digest — Suno source code and dataset manifests leaked in a supply-chain compromise reported to trace back to the Shai-Hulud npm worm, exposing a youtube_music corpus of 2,013,545 clips / 113,879 hours plus tens of thousands of additional hours from Deezer, Genius, Pond5, IMSLP, Jamendo, and podcast RSS feeds. Prior music-AI provenance record (Udio’s April 2026 SDNY admission, The Atlantic’s earlier Suno/Udio corpus mapping) established the fact of YouTube scraping; today’s leak establishes it at the source-code level — dataset manifests with exact clip counts and hours per source, at a granularity discovery motions had not previously reached. Sony and residual UMG claims sit before Judge Saylor with dispositive motions currently reset to April 9, 2027 and statutory damages sought at up to $150K per work plus $2,500 per act of circumvention under DMCA §1201. Narrow read: the incremental legal risk is DMCA §1201 (circumvention of YouTube anti-scraping), not the pure infringement question the settled UMG matter mostly cleared. Structural read the corpus carries: training-set provenance for generative-audio labs is no longer an inference exercise — a source-code leak sets the discovery-motion template for the remaining Sony case and for the next round of publisher suits against any music-AI vendor with public-web-scraped training data. 30-day watch: whether Sony files an amended complaint that cites the leaked manifests as evidence — the fastest possible signal that source-code disclosures now materially move litigation.
  • 2026-09-14-AI-Digest — Suno replaced its entire generation stack with a new v6 family — flagship v6, v6-wild, v6-mini — trained on data licensed from Warner Music Group, BMG, and Believe as copyright suits progress. Prior Suno models are being retired rather than dual-served; all traffic moves to the licensed model. Deal structure per Billboard is revenue share (“a portion of Suno’s revenue to labels from the start”) — not upfront license, not equity — with specific terms, splits, and formulas undisclosed. WMG licensed only a subset of catalog; no Universal or Sony data in the training set. The deals follow WMG’s Nov 2025 settlement with Suno. Two structural points worth carrying. First, this is the first frontier-modality lab to swap its production model for a licensed-training successor under settlement pressure — a genuine data point, not a hypothetical. Second, the “template for video and code” framing you’ll see in secondary coverage is overstated: Runway, Pika, GitHub Copilot, and code-gen labs have not announced licensed-only retraining, and Suno’s move is driven by discovery-heavy music litigation where training-data provenance is uniquely traceable via melodic fingerprinting; NYT-vs-OpenAI is still ongoing without a licensed-retraining outcome. Carry as first modality to trade capability continuity for legal defensibility, not template every generative-media shop will follow. Extends the 2026-07-17-AI-Digest source-code leak and 2026-07-22-AI-Digest 55.3M-user breach as the provenance-and-discovery context inside which today’s licensing pivot lands. Log against MOC - Major Companies.

Key Developments

  1. First Source-Code-Level Provenance Disclosure for Generative Audio (July 17, 2026): Supply-chain compromise (reported Shai-Hulud npm worm) leaks Suno source code and dataset manifests including youtube_music at 2,013,545 clips / 113,879 hours plus tens of thousands of hours from Deezer, Genius, Pond5, IMSLP, Jamendo, and podcast RSS feeds. Moves the music-AI provenance question from inferred (Udio’s SDNY admission, The Atlantic’s corpus mapping) to source-code-level, with exact clip counts and hours per source at a granularity that discovery motions had not previously reached. The incremental legal risk is DMCA §1201 (circumvention of YouTube anti-scraping) rather than the pure infringement question the settled UMG matter mostly cleared. Sets the discovery-motion template for the remaining Sony case and the next round of publisher suits against music-AI vendors with public-web-scraped training data.

See also: MOC - Major Companies.