404 Media put an AI song on a real band’s Spotify page without its consent

404 Media generated a song with Udio and released it as “Riding High” on the verified streaming pages of Brooklyn punk band Lathe of Heaven—without the band’s knowledge.

The track appeared not only on Spotify but also Apple Music, Tidal and Amazon Music. It sounded unlike the band and used different artwork, yet the distribution pipeline accepted the submitter’s artist association. A scammer can exploit the same weakness to borrow an established name’s search traffic, collect royalties and flood a catalogue with cheap AI music.

The important vulnerability predates generative AI. Streaming services rely on distributors to supply releases and match them to artist identities, while distributors rely on platform identifiers and metadata without consistently obtaining direct confirmation from the artist. AI changes the economics: producing plausible-enough tracks is now nearly free, so a weak identity check can be attacked at scale.

Neither platforms nor distributors have accepted full responsibility, according to the investigation. Takedowns after a musician complains address individual tracks but leave the admission path intact. A durable fix would require verified artist-controlled approval for catalogue additions or a distributor identity system whose attestations carry liability.

The experiment was ethically sensitive because it temporarily placed unauthorized work in a real catalogue, but it supplied evidence a headline could not: the researchers reproduced the scam end to end across several major services, showing that this is an identity and payments failure rather than merely a problem of detecting synthetic audio.