AI music can hijack a real artist’s streaming page with alarming ease

A 404 Media investigation found that an AI-generated song could be placed on a real band’s Spotify, Apple Music, Amazon Music and Tidal pages without the band’s knowledge. The loophole turns a familiar artist profile into a storefront for somebody else’s synthetic music, with royalties potentially following the impersonator.

Watch Desk analysis

What happened

404 Media reporter Emanuel Maiberg created a punk track with Udio, made its cover art with ChatGPT and uploaded it through DistroKid under the name of Brooklyn band Lathe of Heaven. The distributor matched the submission to the band’s existing streaming profiles, and the track appeared on those pages a day later.

The report says the upload process relied on unchecked declarations that the uploader had recorded the music and was authorised to sell it. Spotify, Apple Music, Amazon Music, Tidal and Deezer carried the track, according to 404 Media’s account. The band’s vocalist, Gage Allison, said the group had not written, performed or approved the release.

The investigation also cites more than 300 suspected AI-generated tracks placed under the names of real artists, including dead musicians and people who are not musicians at all. Spotify said actively managed profiles can be especially vulnerable and pointed to an opt-in tool allowing artists to review incoming releases before publication.

Why it matters

This is not chiefly a debate about whether AI music sounds good. It is an identity and distribution problem. A listener can click a trusted artist page, hear an imitation or unrelated track, and assume the artist made it. The artist may lose royalties, reputation and control of their own catalogue while platforms argue over whose checkbox failed.

The scale makes manual policing difficult. Deezer told 404 Media it receives more than 100,000 new tracks a day and has seen increasing attempts to hijack artist pages with AI-generated fake albums. Automatic AI detection is not a clean answer either: Spotify said detection systems can produce false positives and become obsolete as generation tools change.

Our read

The useful finding is brutally practical: platform identity checks are weaker than the public-facing artist pages they protect. Spotify’s profile-protection tool is a start, but making artists opt in to defend their names leaves smaller acts and inactive catalogues carrying the burden.

Streaming services and distributors should make artist identity protection the default, publish clear takedown times and show who receives royalties while a disputed release is live. Otherwise the industry is asking musicians to perform unpaid fraud detection between rehearsals.

What to watch

• Default protection:
  Whether platforms extend approval controls to all artists rather than making them opt in.
• Distributor checks:
  Whether services verify ownership before matching a release to an existing profile.
• Takedown speed:
  How quickly disputed tracks and diverted royalties are removed or frozen.
• Artist liability:
  Whether smaller and inactive acts receive the same protection as major stars.

Discussion spark: Should streaming platforms be legally required to verify artist identity before publishing a release to an existing profile, even if that makes distribution slower and more expensive?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.