A Reporter Hijacked a Real Band\'s Spotify With AI Music in One Day — Here's How

On September 10, 2026, the Brooklyn punk band Lathe of Heaven "released" a new single called Riding High on its verified Spotify page. Fans immediately knew something was wrong: it sounded nothing like the band, the vocals weren't singer Gage Allison's, and the cover art didn't match. That's because the band never made it — a reporter did, with an AI music generator, to prove how broken music streaming has become.

The Experiment

Emanuel Maiberg of 404 Media generated the song with a simple prompt on the AI music tool Udio, made cover art, and signed up for the digital distributor DistroKid. When he typed in the artist name "Lathe of Heaven," the distributor automatically matched it to the real band's existing streaming profiles and asked if that was him. He said yes, ticked boxes claiming he owned the music, and uploaded.

Nobody checked. A day later, the AI track was live on the band's Spotify, Apple Music, Tidal, and Amazon Music pages — collecting royalties that would flow to the uploader, not the band.

Timeline: The AI Music Scam Epidemic

Why This Loophole Exists

Musicians don't upload to each streaming service by hand — they use distributors that push one upload to every platform at once. That convenience is the weak point: distributors match artist names automatically and take the uploader's word on ownership. The loophole predates generative AI, but AI removed the last friction. Anyone can now generate unlimited songs, covers, and artist identities in minutes.

Smaller and inactive artists are the prime targets — their profiles aren't watched closely, and neither are dead musicians' catalogs. Tidal now marks suspected AI releases with a visible icon; Spotify says it's building a labeling system and will stop recommending such releases.

How Artists Can Protect Themselves

Until distributors fix the loophole, artists aren't powerless:

• Claim and monitor your profiles. Spotify for Artists and Apple Music for Artists let you claim your pages and get notified of new releases. Unmanaged profiles are the prime targets.
• Set up Google Alerts for your band name + "single" or "new release" to catch hijacks early.
• Report fast. Both Spotify and distributors have impersonation reporting flows — the 404 Media test track was removed after exposure, but speed matters because scammers collect royalties per stream.
• Watch the metadata. Some hijacks come from innocent-looking metadata errors (two artists, same name). Distinguish your artist profile clearly everywhere.

The industry fix is obvious: distributors should verify identity before attaching uploads to existing artist profiles — the way YouTube verifies channels or banks verify accounts. Spotify has said it's building AI-content labeling and will stop recommending suspected AI releases. Tidal already marks them with an icon. But the core loophole — type any name, tick a box, publish worldwide — remains open.

The uncomfortable truth: until distributors verify identity the way banks do, your favorite band's next "single" might not be theirs at all.