On September 10, the Brooklyn punk band Lathe of Heaven released a new single on its verified Spotify page called Riding High. Fans would have immediately noticed the vocals were not from lead singer Gage Allison, the song sounded nothing like previous work, and the album cover differed from the band’s established style.
Lathe of Heaven did not write, perform, or willingly release the track. I created the song using the AI music generator Udio and uploaded it to the band’s official Spotify, Apple Music, Tidal, and Amazon Music pages without their knowledge. I exploited a loophole in how digital distributors handle music uploads.
The loophole has existed for years, but users now widely abuse it to flood artist pages with AI content. Scammers collect royalties generated by streams while listeners expect music from their favourite artists. While various instances of this scam have been documented previously, 404 Media identified and replicated the exact method. It is trivial to execute, and neither streaming platforms nor distributors are taking responsibility.
The vulnerability appears more likely to affect lesser-known artists or those no longer alive, though famous musicians can also be targeted. Spotify stated that “profiles that aren’t actively managed can be especially vulnerable,” meaning a lack of active monitoring makes a page an easier target.
Last year, I reported on Blaze Foley, a country musician murdered in 1989, whose Spotify page featured new AI-generated music under his name. I have recently reviewed dozens of examples of other deceased musicians publishing AI tracks under their names. In some cases, album covers for Black jazz musicians feature white, AI-generated artists instead.
The Loophole
Digital music distributors help musicians deliver and manage their music online. Instead of uploading to each streamer separately, artists upload to one distributor, which then places the music on chosen platforms. This allows artists to manage their catalogue and collect earnings from a consolidated service.
This convenience is easily exploited by bad actors.
To take advantage of it, I created a song on Udio with the prompt “generate a punk song with male vocalist” and made the album cover with ChatGPT. I created an account with Distrokid for $3.75 a month and uploaded the track. When Distrokid asked for my artist or band name, I typed in Lathe of Heaven. The service automatically found the existing pages for the real band and asked if that was my group. It then requested information required by music streaming platforms, including composers, producers, and record labels. I entered my real name and listed 404 Records as the label.
Distrokid required me to check several boxes. One stated: “I recorded this music, and am authorized to sell it in stores worldwide & collect all royalties.” Another said: “I’m not using any other artist’s name in my name, song titles, or album title, without their approval.” I checked the boxes. Neither Distrokid nor the streaming platforms verified any of my answers.
Once I finished the form, Distrokid said it was publishing the song on 24 different music streaming platforms.
A day later, my AI-generated song and album cover appeared on Lathe of Heaven’s real Spotify, Amazon Music, Apple Music, Tidal, and Deezer pages. A regular user would have no way of knowing the band did not upload the song or that royalties would go to me.
“I just listened to the song. It’s appalling. The fact that you were able to do that is insane,” Allison told me. “The only thing smaller musicians like us have at the end of the day is recognition for the results of our work — being able to enjoy the process of creating something and putting it out into the world knowing it is distinctly a product of our own hands is essentially one of the last driving forces behind making music. It’s hard enough putting this much time and effort into the band as it is. All the members of LoH essentially tailor our lifestyles around having the time to tour, write records and record. And we do it knowing we will likely not see much money in return. The fact that someone could ruin our reputation by dropping this cringe garbage under our name is insanely disheartening and speaks volumes about distribution and streaming services that allow this to happen.”
“100,000 New Tracks Per Day”
This distribution method is widely abused. In July, musical duo Odette Child began finding AI-generated music on streaming platforms pretending to come from real artists. They shared findings on Instagram. So far, they have discovered more than 300 AI-generated songs pretending to be written by everyone from Taylor Swift to relatively unknown Broadway musical performers, to dead jazz musicians, and even some celebrities who are not musicians but whose names and likenesses are used for these tracks.
Odette Child told me they forwarded the list of AI-generated songs to Spotify, which thanked them but took no action against the AI slop.
“These are not new loopholes. These are not new things being exploited,” Odette Child told me. “We’re musicians. We want to be releasing stuff in a digital space. In a lot of ways, this is extremely distressing, scary, and threatening to our livelihoods. And yet we can just see very clearly that they are not interested in the best possible solution to this problem. We need some sort of infrastructure that can protect us from this as consumers, listeners and especially as artists.”
AI slop is so prevalent on music streaming platforms like Spotify there are now several third party services that help users filter out AI-generated music. In August, Spotify announced it is introducing a new tag to identify AI-generated artists on the platform, but it is still full of undisclosed AI music, some of which pretends to come from human artists. Even platforms that have taken a stronger position about labeling AI music and protecting human artists, like Deezer and QoBuz, face similar issues.
