Security1 publisher2 min readPublished
Typing a band's name into DistroKid published an AI track to its verified Spotify page
404 Media paid $3.75 for a DistroKid account, typed Lathe of Heaven into the artist field and checked two boxes swearing it owned the music. A day later the AI track was live on the band's real pages at five services.
The Watch · Security desk
What happened
- On September 10 a single called "Riding High" appeared on the verified Spotify page of the Brooklyn punk band Lathe of Heaven, which had not written, performed or released it.
- A 404 Media reporter generated the song with the prompt "generate a punk song with male vocalist" in Udio and produced the album cover with ChatGPT.
- He uploaded the file through a DistroKid account costing $3.75 a month, entering his own name as composer and producer.
- Typing "Lathe of Heaven" into the artist name field made DistroKid surface the real band's Spotify, Tidal, Apple Music and Amazon pages and ask whether they belonged to him.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Detection depends on someone opening the artist page and noticing a release they did not make, so estates, inactive bands and dormant catalogs are the parties who have to do that watching.
- cost The fraud is paid for by the real artist's audience, and the outlay to start collecting is a single monthly distributor subscription.
- constraint A verification badge tells a listener who the artist is and nothing about who is allowed to publish to that page.
- precedent While authorization is asserted by the uploader on a form, the only remedy is a takedown after the streams have already counted, and every distributor that name-matches to an existing page works the same way.
The identity check is a checkbox. DistroKid asked the uploader to affirm "I recorded this music, and am authorized to sell it in stores worldwide & collect all royalties" [7] and "I'm not using any other artist's name in my name, song titles, or album title, without their approval" [8]. He checked both. Nothing in the pipeline tested either statement, or the record label he entered, which was 404 Records [6][9].
The distributor did the hard part of the impersonation. Typing the band name returned the real band's Spotify, Tidal, Apple Music and Amazon pages, plus a prompt asking whether they were his [5]. All the uploader has to know is the spelling. Spotify accepts the distributor's delivery, and the distributor accepts the uploader's word [18][9].
DistroKid said it was publishing the track to 24 streaming platforms [10]. 404 Media confirmed five of them: Spotify, Amazon Music, Apple Music, Tidal and Deezer, one day later [11][21]. At $3.75 a month [4] spread across the 24 platforms in the claim, that is about 16 cents per platform [20]. Royalties from the resulting streams go to whoever uploaded the file [16].
A fan of Lathe of Heaven would catch it on the first bar. The vocals are not lead singer Gage Allison's, and the album art does not match the logo the band had been using [19].
Spotify told 404 Media that "profiles that aren't actively managed can be especially vulnerable" [12]. 404 Media found the method works better against lesser-known and dead artists than against famous ones [13].
404 Media reported last year on Blaze Foley, a country musician murdered in 1989, whose Spotify page began carrying new AI-generated tracks under his name [14]. The publication says it has since reviewed dozens of other dead musicians with AI music published under their names, and that in some cases the covers for dead Black jazz musicians show white AI-generated artists [15].
404 Media describes the loophole as years old, now widely abused by people making AI music, and disowned by both the streamers and the distributors [17]. The story does not quantify how many pages have been hit. The documented set is those dozens of posthumous catalogs [15] and one live test on a working band [1].
What to watch
- Whether DistroKid requires proof of control of an existing artist page before matching a typed name to it.
- Whether Spotify moves the authorization decision to the account that already holds the artist page, instead of accepting the distributor's delivery.
- Whether royalties already accrued to an impersonating uploader are recovered when a fake release is pulled.