Security hole in music distribution allows an artist's Spotify profile to be stolen using AI music
A journalist from the website 404 Media demonstrated that an AI-generated song can be uploaded through the distributor Distrokid to a verified Spotify profile of an existing band without consent – neither Distrokid nor the streaming platforms verify identity in any way.
A journalist from the website 404 Media documented and personally tested a security flaw in the digital music distribution system. Using Udio, he created a song with the prompt “punk song with male vocalist” and an album cover using ChatGPT, then set up an account with the digital distributor Distrokid for 3.75 dollars per month and entered the name of the real Brooklyn band Lathe of Heaven as the artist name. Distrokid automatically linked the existing profiles of the band on Spotify, Apple Music, Tidal and Amazon Music and asked whether it was his band. The journalist simply ticked declarations stating that he owned the rights and was authorized to sell the music – neither Distrokid nor the streaming platforms verified these claims in any way. By the next day, the AI-generated song with the fake cover had appeared on the official profiles of the band on five platforms, including Deezer, without the band knowing.
According to the company Spotify, profiles that no one actively manages are particularly vulnerable – this affects lesser-known or deceased artists. The source mentions an earlier case involving country musician Blaze Foley, who was murdered in 1989 and whose profile had previously featured new AI music, as well as dozens of other cases involving deceased musicians, including Black jazz artists whose album covers were replaced by AI-generated photographs of white performers.
According to the article, the duo Odette Child has discovered over 300 AI-generated songs passed off as releases by real artists since July, ranging from Taylor Swift to little-known Broadway performers and deceased musicians. Gage Allison, the singer of the band Lathe of Heaven, described the attack as “appalling” abuse – in his view, recognition for their own work is one of the last things small bands have left in music.
The rest of the source article was not available; details can be found in the source article.
Why it matters
The flaw allows anyone to take over an existing artist profile on major streaming platforms and collect royalties from fake AI music without the real artist finding out – musicians who receive less attention or are deceased are most at risk. For music distributors and platforms, this is a documented failure of identity verification that creates a risk of royalty fraud and damage to artists' reputations.
Two audiences, two different impacts
What this means
For individuals
An artist whose profile on Spotify is not actively monitored faces the risk of someone releasing an AI-generated song under their name and collecting royalties from it without the artist even knowing – as actually happened to the band Lathe of Heaven.
For a business
Digital music distributors (e.g. Distrokid) and streaming platforms such as Spotify, Apple Music, Tidal and Amazon Music do not verify in any way whether the person uploading a track under the name of an existing band is its actual representative – ticking a declaration box is enough. This creates opportunities for royalty fraud and damage to the platform's brand reputation.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 1 independent. We count feeds from the same owner only once.