On September 10, the Brooklyn-based punk band Lathe of Heaven released a new single on its verified Spotify page called Riding High. Any fan of Lathe of Heaven would have immediately noticed that the song sounded nothing like the band’s previous work, that the vocals were not from lead singer Gage Allison, and that the album cover was widely different from the style and logo the band used previously.
That’s because Lathe of Heaven didn’t write, perform, or willingly release Riding High. I created the song with a simple prompt given to the AI music generator Udio, and I was able to release the track on Lathe of Heaven’s official Spotify page, as well as on its Apple Music, Tidal, and Amazon Music pages, without the band’s knowledge, by exploiting a glaring loophole in the way music is digitally distributed to streaming platforms.
The loophole has existed for years, but people who make AI slop music are now widely abusing it. Today, anyone can easily hijack a real artist’s Spotify page and flood it with AI-generated music. When someone clicks one of those tracks expecting to hear music from their favorite artists, the scammer will collect whatever royalties those streams generate, essentially piggybacking on their popularity, and the listener will hear low quality slop instead of their favorite artist. Various instances of this scam have been documented in the past, but 404 Media was able to identify and replicate the exact loophole scammers are exploiting. It was trivial to do, and neither music streaming platforms nor digital music distributors are taking responsibility for the problem.
It also appears that the loophole is more likely to work against lesser known artists or artists who are no longer alive, as opposed to famous musicians, though they can also be affected. Spotify told me that “profiles that aren't actively managed can be especially vulnerable,” meaning that if someone isn’t actively monitoring an artist’s page on Spotify it’s an easier target.
Last year, I reported on Blaze Foley, a country musician who was murdered in 1989, but whose Spotify page was suddenly featuring new, AI-generated music under his name. I’ve recently reviewed dozens of examples of other dead musicians who are also apparently publishing AI-generated music under their names on Spotify. In some cases, album covers for dead, Black jazz musicians feature white, AI generated artists instead.
The Loophole
Digital music distributors are services that help musicians deliver and manage their music online. Rather than uploading their music to each music streamer separately, artists upload their music to one music digital distributor, which then uploads their music to the platforms of their choosing. This way, artists can manage their catalogue and collect their earnings from a consolidated service rather than manage their music separately across Spotify, Amazon Music, Apple, Tidal, and other platforms.
The consolidation offered by digital music distributors is an incredible convenience, but is also easily exploited by bad actors.
To take advantage of it, I created a song on Udio with the prompt “generate a punk song with male vocalist,” and made the album cover with ChatGPT. I created an account with one of these digital music distributors, Distrokid, for $3.75 a month, and uploaded the track. When Distrokid asked for my artist/band name, I typed in Lathe of Heaven. Distrokid automatically found the existing Spotify, Tidal, Apple Music, and Amazon pages for the real Lathe of Heaven, and asked if that was my band. It then asked me for a bunch of information the music streaming platforms require, like who composed the music, who produced it, and the record label. I put my real name down everywhere and listed 404 Records as the record label.
Distrokid also made me check a few boxes. One said: “I recorded this music, and am authorized to sell it in stores worldwide & collect all royalties.” Another said: “I’m not using any other artist’s name in my name, song titles, or album title, without their approval.” I checked the boxes. Neither Distrokid nor the music streaming platforms did anything to verify any of my answers.
When I was finished filling out the form, Distrokid told me it was in the process of publishing the song on 24 different music streaming platforms.
A day later, my AI-generated song and album cover appeared on Lathe of Heaven’s real Spotify, Amazon Music, Apple Music, Tidal, and Deezer pages. A regular user would have no way of knowing the band didn’t really upload the song, and that any royalties from listening to it would go to me.
“I just listened to the song. It’s appalling. The fact that you were able to do that is insane,” Allison, Lathe of Heaven’s vocalist, told me. “The only thing smaller musicians like us have at the end of the day is recognition for the results of our work — being able to enjoy the process of creating something and putting it out into the world knowing it is distinctly a product of our own hands is essentially one of the last driving forces behind making music. It’s hard enough putting this much time and effort into the band as it is. All the members of LoH essentially tailor our lifestyles around having the time to tour, write records and record. And we do it knowing we will likely not see much money in return. The fact that someone could ruin our reputation by dropping this cringe garbage under our name is insanely disheartening and speaks volumes about distribution and streaming services that allow this to happen.”
“100,000 New Tracks Per Day”
This method of digital music distribution is widely abused. In July, musical duo Odette Child started finding AI-generated music on streaming platforms that pretended to come from real artists. They then shared their findings on Instagram. So far, they’ve discovered more than 300 AI-generated songs pretending to be written by everyone from Taylor Swift to relatively unknown Broadway musical performers, to dead jazz musicians, and even some celebrities who are not musicians, but whose name and likeness are used for these AI-generated songs.
Odette Child told me they forwarded the list of AI-generated songs they compiled to Spotify, and that it thanked them, but didn’t take any action against the AI slop.
“These are not new loopholes. These are not new things being exploited,” Odette Child told me. “We’re musicians. We want to be releasing stuff in a digital space. In a lot of ways, this is extremely distressing, scary, and threatening to our livelihoods. And yet we can just see very clearly that they are not interested in the best possible solution to this problem. We need some sort of infrastructure that can protect us from this as consumers, listeners and especially as artists.”
AI slop is so prevalent on music streaming platforms like Spotify there are now several third party services that help users filter out AI-generated music. In August, Spotify announced it is introducing a new tag to identify AI-generated artists on the platform, but it’s still full of undisclosed AI music, some of which is pretending to come from human artists. Even platforms that have taken a stronger position about labeling AI music and protecting human artists, like Deezer and QoBuz, fall for this loophole. On QoBuz, even Taylor Swift, one of the most famous musicians in the world, has AI music misleadingly published under her name.
“Protecting artists’ identities is a top priority for us, and we continue to invest heavily in detection and prevention,” Spotify told me. “We're employing a layered approach that combines enforcement, artist controls, and greater transparency. Artist Profile Protection, the first tool of its kind from a streaming service, lets artists opt in to review and approve or decline incoming releases before they go live on their profile. We're also working directly with distributors to stop bad submissions at the source, and our spam filter works to flag and stop recommending mass uploads, duplicates, and other low-effort content. As AI technology evolves, we'll continue building on these efforts.”
In August, Spotify told me that one thing that often gets lost in the conversation about AI-generated music on on streaming platforms is that “reliable detection of AI-generated music remains a technically unsolved problem across the entire industry,” meaning Spotify and other streamers can’t just use AI to detect and label AI generated music. “Detection models frequently fail to generalize across different versions of generative AI, are easily tripped up by basic audio processing, and can become obsolete almost overnight when AI companies update their models. The real-world consequence is false positives that harm real artists,” Spotify told me.
For example, in July, Ukrainian musician Andriana-Yaroslava Saienko said on Instagram that TuneCore, another digital music distribution company like Distrokid, said it would not distribute one of her tracks because it was detected as being AI-generated. Saienko said she created the music entirely herself, using only her voice and a few built-in instruments in the popular music production software Ableton. The track, called Praying, is available on her Soundcloud if you want to judge for yourself.
“I fully support filtering AI generated music. I think it's really fair,” Saienko told me in an email. “But my case was about something else — the absence of human communication and any meaningful way to resolve a situation where the AI detection system clearly made a mistake.”
Amazon told me that, as with all content on Amazon Music, it expects uploads to comply with applicable laws and its existing terms of service. “Our robust systems prevent impersonation, deception, and spam, and have led to the removal of tens of millions of tracks from our service in the last year alone, including fraudulent AI-generated content,” Amazon told me in an email. “We’re committed to continuously improving our enforcement through advanced detection technologies and refined monitoring systems, and we’re in regular dialogue with partners and rights holders to ensure we’re protecting artists’ and songwriters’ interests as the landscape evolves.”
Deezer told me that from a streaming platform’s standpoint, it is often hard to know whether a release is legitimate or not because it’s common for artists to change labels or distributors and there is no centralized database of what “legitimate” releases are. On top of that, streaming platforms often have to deal with homonym artists in cases where IPI codes, the unique identification numbers assigned to track music rights and pay royalties, are not provided in the release metadata.
“Keeping track is [a] complex task since we often receive over 100,000 new tracks per day, and our reviews are manual, both through the daily work of our editorial and catalog teams, as well as reports from rights owners and users,” Deezer told me. “While this issue predates the rise of AI, we’ve seen an increase in attempts to ‘hijack’ artists’ pages via AI-generated fake albums. The purpose of the fraudsters is to game platforms into pushing these new releases to users who would usually listen to the original artist.”
Distrokid, the distributor I used to hijack Lathe of Heaven’s pages, did not respond to a request for comment.