Product1 publisher3 min readPublished
404 Media put an AI track on a real band's Spotify page by claiming to be the band
The upload path takes the submitter's word for which artist a release belongs to, so an AI track lands on the real band's catalog page and pays whoever filed it. Spotify's release-review tool has been in limited beta since March.
The Product Desk · Product desk
What happened
- 404 Media tested the loophole with the Brooklyn band Lathe of Heaven, getting an AI-generated track onto the band's catalog through the distribution service DistroKid.
- Once accepted, such a track appears on Spotify, Tidal, Apple Music and Amazon Music as a new release by the real artist, and it clears both the distributor and the store.
- Royalties from the fake track go to whoever submitted it, not to the artist whose name and profile page the release is attached to.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- constraint Better synthetic-audio detection leaves this path open, because the same submission path worked for human-made impersonations before Suno and Udio existed. The unverified identity claim is what has to change.
- exposure Anyone with a distributor account can reach a catalog page that nobody is watching daily. That leaves estates and small bands in the position Spotify itself describes as especially vulnerable.
- cost The artist pays twice, losing the royalties on a track they did not make and doing the searching that finds it, while the platforms handle the case only once someone complains.
- decision Any team running profile pages that carry someone else's name now has to pick a side: verify the claim at submission, or keep resolving it after publication with the named party absorbing the error.
The check that failed is a claim of identity. Whoever submits a release names the artist it belongs to, and the distributor passes that name downstream to the stores. Emanuel Maiberg of 404 Media wrote: "it is shockingly easy to post AI generated music under the name of real artists on Spotify. It took us five minutes to do. You can do it to small bands, dead artists, even Taylor Swift." [7] The generated song came from a tool like Suno or Udio and the cover art from another model [4].
Spotify's public answer is about audio. The company said "protecting artists' identities is a top priority for us, and we continue to invest heavily in detection and prevention," and that it is "working directly with distributors to stop bad submissions at the source" [17]. Amazon Music said it is "committed to continuously improving our enforcement through advanced detection technologies and refined monitoring systems" [19]. A classifier that scores audio for synthetic origin is checking something else. Engadget notes the loophole predates the AI slop wave; what generative tools changed is how many false submissions one person can file in a day [12].
The product change that addresses identity is the tool letting musicians review releases before they attach to their profile. It was announced in March and was still in limited beta when 404 Media published [13], roughly six months later [20]. Until it ships, control comes after publication.
"The fact that someone could ruin our reputation by dropping this cringe garbage under our name is insanely disheartening and speaks volumes about distribution and streaming services that allow this to happen," Lathe of Heaven's vocalist told 404 Media [10]. Big acts have staff who check; small ones and dead ones do not [18]. Spotify confirmed to 404 Media that "profiles that aren't actively managed can be especially vulnerable" [9].
The only prevalence number in the story is a hand count. Odette Child started logging cases in July and has found more than 300 AI songs posing as major acts, celebrities and dead jazz musicians [11]. Estimates of AI uploads to Spotify run around 50,000 a day [14]; over the roughly 60 days from July to the report, that is about 3 million tracks, so 300 works out to 0.01 percent of the flow [21]. The 300 is what two musicians turned up by searching.
For anyone running a product where pages carry a name someone else owns, two questions set the exposure. Is the identity claim verified before publication or contested after a complaint. And when the attach is wrong, does the platform absorb the cost or does the named party. Here the claim is a few boxes on a distributor's signup form [8], and the named party absorbs it, because the royalties on the fake track go to the uploader [2].
"We can just see very clearly that they are not interested in the best possible solution to this problem," Odette Child said [15]. "We need some sort of infrastructure that can protect us from this as consumers, listeners and especially as artists" [16].
What to watch
- Whether Spotify's release-review tool leaves limited beta, and whether it is on by default for profiles that aren't actively managed.
- Whether DistroKid and other distributors add an identity check at submission. Spotify says that is where it wants bad submissions stopped.
- Whether anyone other than volunteer musicians publishes a count of impersonation uploads and takedowns.