I Hijacked a Real Artist's Spotify with AI Music. It Was Disturbingly Easy

On September 10, punk band Lathe of Heaven unveiled a new single on their verified Spotify page titled "Riding High." However, avid fans would quickly notice the song had an unfamiliar sound, the vocals didn't match lead vocalist Gage Allison, and the album cover differed significantly from the band's usual style. Clearly, Lathe of Heaven didn't write, perform, or release the track themselves.

I generated the song using the AI music generator Udio, based on a simple prompt, and released the track on Lathe of Heaven's official Spotify, Apple Music, Tidal, and Amazon Music pages without the band's knowledge. This was made possible by exploiting a loophole in how digital music distributors distribute tracks to streaming services.

The loophole has been around for years, but AI-generated music scammers are now widely abusing it. Anyone can easily hijack a real artist's Spotify page and flood it with AI-generated music. When someone clicks one of those tracks expecting authentic music, they're actually listening to low-quality nonsense, while the scammer pockets the royalties.

Multiple instances of this scam have been documented, but 404 Media identified and replicated the exact loophole scammers are exploiting. It was trivial to do, and neither music streaming platforms nor digital music distributors are addressing the issue. It seems the loophole is particularly exploitable against lesser-known artists or deceased ones. Spotify confirmed that "profiles not actively managed can be especially vulnerable."

This scam impacts not only artists' reputations but also their financial stability. Last year, I reported on Blaze Foley, a country musician who died in 1989, whose Spotify page suddenly featured AI-generated music under his name. I've reviewed dozens of dead musicians experiencing the same issue. In some cases, album covers for deceased black jazz musicians showcase white AI-generated artists instead.

The digital music distributor, Distrokid, facilitated this scam. By uploading the track with my chosen artist/band name, Distrokid automatically found the existing pages for the real Lathe of Heaven and asked for various album details. I filled in my real name and listed 404 Records as the record label, checked the required boxes, and within a day, my AI-generated song appeared on Lathe of Heaven's Spotify, Amazon Music, Apple Music, Tidal, and Deezer pages.

A real user would have no way of noticing the deception, as any royalties from the streams would go to me instead of the band. Lathe of Heaven's vocalist, Gage Allison, expressed his dismay about the situation. The convenience of digital music distribution is unparalleled, but it's clearly being exploited by bad actors. I'm eager to hear more about these scams and am available for secure communication via Signal or email.