Reporter puts an AI song on a real band’s streaming pages

An AI-generated punk song appeared on Lathe of Heaven’s official pages across five streaming services without the band’s knowledge, according to 404 Media reporter Emanuel Maiberg, who uploaded it himself. His experiment exposes a weakness in a familiar listening habit: finding a song on a real band’s page does not establish that the band released it.

Maiberg says “Riding High” appeared on September 10 after he generated the music with Udio and submitted it through DistroKid, a distributor that delivers recordings to streaming platforms. A day after submission, he found it on the band’s Spotify, Apple Music, Amazon Music, Tidal and Deezer pages. This is 404’s reported experiment; we did not independently reproduce the upload or inspect its account records.

The telling detail is how little concealment the upload required. Maiberg says he used his own name in the requested credits and listed “404 Records” as the label. DistroKid asked him to confirm that he could sell the recording and had approval to use the artist’s name. He checked the boxes, and says neither the distributor nor the platforms verified those answers before publication. DistroKid did not respond to 404’s request for comment.

The reported failure was in connecting a recording to an artist, without establishing permission. Maiberg did not need to reproduce the band’s sound: he generated a generic punk song with a male vocalist. Lathe of Heaven singer Gage Allison told 404 Media:

“The fact that you were able to do that is insane”

Gage Allison, Lathe of Heaven vocalist, speaking to 404 Media

Allison’s concern was reputational: listeners could judge the band by music it never made. The report establishes that the song reached its pages, but does not establish how many listeners encountered it or whether Maiberg received royalties.

A verified artist is not an approved release

Spotify’s verification badge concerns the artist profile and signals of an authentic human artist. The unauthorized placement on Lathe of Heaven’s verified page, as reported by 404, illustrates the separate question of who approved a particular recording.

Spotify pointed 404 to Artist Profile Protection, which lets eligible artists review incoming releases. Its documentation adds a consequential qualification: the feature remains a limited beta, and under its ordinary setting, a release goes live if the artist takes no action. A stricter setting requiring approval is being tested with a smaller group. Some providers’ deliveries may be ineligible, and the evidence does not establish whether Lathe of Heaven had access or could review this release.

AI labeling addresses another question again. Spotify says its AI Persona badge describes whether a profile represents a real person, rather than how a track was created. Our read is that detecting synthetic music cannot settle the permission problem: a system still needs to establish whether someone may publish under the band’s name.

The scale is harder to pin down

Deezer told 404 that attempts to attach fake AI albums to artists’ pages had increased. It described a longstanding difficulty: artists change distributors, names overlap, and there is no centralized database of legitimate releases. Cheap generation gives uploaders an easier way to supply recordings to that existing distribution system.

The companies’ large numbers do not measure this particular abuse. Amazon told 404 it had removed tens of millions of tracks in the previous year, including fraudulent AI content. Separately, Deezer reported roughly 90,000 fully AI-generated tracks arriving daily at June’s peak. Neither figure tells us how many releases were falsely attached to real artists.

What to do when a fake appears

Artists and listeners have reporting routes, although correcting the association can require separate requests across services:

1. Spotify artist teams can submit the Spotify for Artists content-mismatch form or contact their distributor.
2. Listeners who spot incorrectly attributed music can contact Spotify customer service through the guidance on that same support page.
3. DistroKid users can report someone else’s music on their page through Fixer, submitting a separate request for each affected service.

Spotify says it usually emails artists within a few days after fixing a mismatch. DistroKid’s guidance says corrections generally take several days but sometimes several weeks, and advises checking the service because it receives no completion notification. Those are general timelines, not established removal times for “Riding High.”

For listeners, checking an unexpected release against the band’s own announcements is a sensible extra step. For platforms, the more consequential test is whether an unauthorized association can be stopped before publication. Artists should not have to discover a release bearing their name by listening to it alongside their fans.