An AI Song Reached a Real Band’s Streaming Pages in Days

A reporter’s experiment with an AI-generated track demonstrated how easily a release can be routed to the catalog of an artist who had nothing to do with it. The concern is bigger than one fake song: when distributors and streaming services do not reliably confirm who is authorized to publish under an established artist identity, a bad actor can exploit the same delivery infrastructure legitimate musicians use. 1

What happened in the Lathe of Heaven test

404 Media reported that its journalist generated a song using Udio, uploaded it through DistroKid in roughly five minutes, and released it as “Riding High.” Within days, the track appeared on the official artist pages of Brooklyn punk band Lathe of Heaven on Spotify, Apple Music, Tidal, and Amazon Music—without the band’s knowledge. 1

The experiment did not depend on breaking into the band’s accounts. Instead, it used the normal distribution pipeline that sends music and release information from a distributor to digital streaming services. Engadget, reporting on the test, described the result as inserting a synthetic track directly into a pre-existing artist catalog through a distribution loophole. 19

The weak point: artist-page routing is not the same as artist authorization

Music services need to match each incoming release to the right artist page. DistroKid’s own support materials state that uploaders can specify the correct artist pages for services in the upload form, while also noting that artist-page mapping is ultimately handled by the services. 28

That convenience can become a vulnerability when the system treats supplied release information as sufficient to associate a track with a known artist profile. A track can then look like an ordinary addition to a real artist’s discography rather than an obvious imitation account.

This problem also affects innocent name collisions and accidental misattribution. DistroKid provides a Fixer workflow for artists whose music is on the wrong page or whose page contains another artist’s music, with separate requests required for each service. 24 But a correction system does not prevent an unauthorized association from reaching listeners in the first place.

Why fraudulent uploads can create a financial incentive

The uploader’s distributor account is generally the account positioned to receive royalties generated by its delivered release. Reporting on artist imposters has described how independent distributors pay artists or rights holders for streams, creating an incentive for a fraudulent uploader to claim a release and seek plays. 22

The potential harm is not limited to ordinary listener confusion. If a fraudulent track receives artificial streams, the incentives can be amplified. DistroKid defines artificial streaming as using artificial means to increase stream counts and says releases with predominantly artificial streams may be removed and their royalties withheld. 27

Still, enforcement after streams occur is different from stopping an unauthorized release from being attached to an artist profile before it goes live.

Why generative AI makes the older problem easier to scale

Artist-page mix-ups, unauthorized uploads, and streaming fraud predate generative AI. AI changes the economics: it can make large numbers of inexpensive, disposable tracks quickly, giving bad actors more material with which to test distribution and profile-matching systems.

The scale should be described carefully. The supplied evidence does not establish a platform-audited figure of 50,000 AI songs uploaded to Spotify each day. Publicly reported figures instead include Deezer’s estimate of 75,000 fully AI-generated tracks arriving daily in April 2026, representing 44% of its daily uploads. 5051 Spotify has separately said it removed more than 75 million “spammy tracks” over a 12-month period, an indication of the broader abuse problem but not a count of daily AI uploads. 5659

Reports have also documented musicians finding suspicious or unauthorized music tied to their identities. The Guardian reported that jazz musician Jason Moran was among artists targeted by apparent AI impersonation on streaming platforms. 56 A report citing researcher Odette Child said she had identified more than 300 fake AI tracks attributed to real artists, including Taylor Swift and deceased jazz musicians. 48

Why musicians say the damage goes beyond royalties

For an artist, a fraudulent release can mislead fans about what they made and what they stand for. It can also clutter a release history that listeners, recommendation systems, journalists, and collaborators may use to understand the artist’s work.

In the Lathe of Heaven case, the issue was particularly acute because the track appeared under an established band identity rather than on a clearly separate imitation page. The band’s reputation, audience trust, and artistic authorship were put at risk even if the fraudulent release generated little money. 1

That distinction matters: a platform can remove a bad track later, but it cannot fully undo listener confusion or the burden placed on artists to discover, document, and challenge the release.

Spotify’s response: more control, but not universal prevention

Spotify has introduced Artist Profile Protection, an optional feature in Spotify for Artists that adds a review step for releases delivered to a protected profile. It can notify artists when music is delivered and allow them to remove themselves from incorrect releases. 3242

The feature is meaningful progress because it moves some review closer to publication. Spotify says protected artists receive a unique artist key they can share with trusted distributors, and that during the beta releases from most—but not all—providers require approval or an artist key. 36

But the limitations explain why critics view it as incomplete:

• It is optional and currently available only to a limited group of artists in beta. 32
• The beta does not cover every delivery provider in the same way. 36
• It applies to Spotify, not automatically to Apple Music, Tidal, Amazon Music, or other services affected by the 404 Media test. 1
• It gives artists control over review and removal, but it does not establish a universal, cross-platform requirement that distributors verify authorization before associating a new release with an existing artist identity.

Spotify’s separate Verified by Spotify badge indicates that an artist profile has been reviewed against the company’s authenticity and trust criteria. 34 That may help listeners identify an established profile, but it is not, by itself, a guarantee that every newly delivered track on that profile was authorized by the artist.

What would make the system harder to abuse

The reporting points to a straightforward principle: a request to place a new release on an existing artist profile should require stronger proof of authorization than a name match or routing instruction alone.

A more durable approach would combine trusted distributor relationships, artist-controlled approval keys, pre-release notifications, and a cross-service method for resolving disputed mappings quickly. Spotify’s beta is a step toward that model, but the Lathe of Heaven experiment shows why reactive reporting tools and limited opt-in protections leave a meaningful gap. 136

For now, artists should monitor their streaming profiles, claim their artist-management accounts, and use distributor and platform correction workflows promptly when a release is misattributed. Those measures can reduce the duration of an error or attack; they do not eliminate the need for stronger identity verification upstream. 2432