404 Media placed an AI song on Lathe of Heaven’s verified Spotify page

A track made with the AI music generator Udio was posted to the verified Spotify page of the Brooklyn punk band Lathe of Heaven without the band’s knowledge, in a test of a distribution loophole. The song, “Riding High,” appeared on Sept. 10 and was also delivered to the band’s pages on Apple Music, Tidal and Amazon Music. 404 Media, which conducted the experiment, said the track sounded unlike Lathe of Heaven’s earlier work, did not use the lead singer’s vocals and carried cover art unlike the band’s usual visual style. It created the song with a simple Udio prompt to demonstrate a route that it said has existed for years but is now being widely exploited with AI-generated music. The process required no hacking. A would-be uploader can generate a song and cover image, subscribe to a digital distributor, and claim to represent an established act. In the test, the distributor found Lathe of Heaven’s existing streaming profiles and asked whether they belonged to the uploader. The false claim was accepted, at a subscription cost of $3.75 a month. Neither the distributor nor the streaming services stopped the submission. Within a day, the song was live as a new release by the real band, and the streaming royalties went to the experimenter rather than Lathe of Heaven. The scheme can outperform ordinary AI-generated music by borrowing an established name, profile and ready-made audience. The band’s vocalist called the ability to release “cringe garbage” under its name “insanely disheartening,” saying it reflected poorly on distribution and streaming services that permitted it. Spotify told Technology.org that artist profiles which are not actively managed can be especially vulnerable. The vulnerability predates generative AI, since a person could upload a dummy track under another artist’s name. But generative tools allow a single person to create and submit hundreds of tracks in a day. Estimates put the number of AI-generated songs uploaded to Spotify daily at roughly 50,000. The problem is not confined to Lathe of Heaven. Odette Child, a musical group that began tracking it in July, said it had identified more than 300 AI-generated tracks falsely presented as releases by major acts and other artists. The group argued that artists, listeners and consumers need infrastructure to protect them. Earlier in 2025, AI-generated tracks also appeared on the official pages of the late country singers Blaze Foley and Guy Clark. Deezer’s data showed AI tracks exceeding half of its daily uploads in June, after accounting for 44% only months earlier; the service’s AI volume had peaked at an average of 90,000 tracks a day. Up to 85% of streams on fully AI-generated tracks in 2025 were fraudulent, and Deezer excludes such streams from royalty payments. Spotify has introduced several measures aimed at impersonation and spam. In September 2025, the company said it had removed more than 75 million spammy tracks in the preceding 12 months, adopted an impersonation policy requiring an artist’s authorisation for vocal impersonation, and was testing prevention measures with distributors. It also said it was expanding its content-mismatch process so artists could flag releases before publication, while developing a filter for mass uploads, duplicates, SEO hacks and artificially short tracks. A newer optional feature, Artist Profile Protection, is intended to address incorrect profile matching, impersonation and ingestion errors. Label Engine says the invite-only beta uses a unique artist key that artists provide to trusted distributors for delivery metadata. Releases without the key are marked “Needs Approval” in Spotify for Artists; artists and their teams have up to 28 days after release to act, and an unaddressed release will not list the artist. The protection applies only to releases delivered after an artist opts in, while profiles that have not opted in continue to receive releases through the existing process.