A song appeared on Lathe of Heaven's Spotify page. A reporter put it there, and the band had no idea
On September 10 a new single showed up on a Brooklyn punk band's verified Spotify page. Different voice, different artwork, and nobody in the band had ever heard it.
The song is called Riding High. It sat on the official, verified Spotify page of Lathe of Heaven, a Brooklyn-based punk band, alongside their real records. Any actual fan would have spotted it in seconds: the vocals were not lead singer Gage Allison, and the cover art looked nothing like the style and logo the band had used before.
It was written by nobody. Emanuel Maiberg, a reporter at 404 Media, made it with one simple prompt in the AI music generator Udio and then pushed it onto the band's pages on Spotify, Apple Music, Tidal and Amazon Music — without the band's knowledge. He described the process in one word: trivial.
This is not a hack. Nothing was broken into, no password was stolen. It is the plumbing of digital music working exactly as designed: a track handed to a digital distributor with the right artist attached can land on that artist's official page. 404 Media says it identified and replicated the exact loophole scammers are using — and that the loophole has existed for years, while people making AI slop music are now widely abusing it.
The payoff is money. Someone clicks what looks like a new song from a band they like, and whoever uploaded the fake collects whatever royalties those streams generate. The fan hears low-quality slop. The band hosts it on their own page.
Anyone can do this today. To a stranger's page. In an afternoon.
And here is the part that should bother people more than the trick itself: 404 Media reports that neither the music streaming platforms nor the digital music distributors are taking responsibility for the problem. Two industries, one door left open, and both pointing at each other. That is why this keeps happening rather than getting fixed.
Anyone making music without a label behind them — the 22-year-old putting a first track on Spotify through a cheap distributor, hoping for a few hundred listeners. Their page is the product, and someone else can post on it. Also everyone paying a monthly streaming subscription: you are the one who clicks the fake track, and your listening is what pays the person who uploaded it. And fans of small bands like Lathe of Heaven, who now have to check whether the new single on the page was made by the band at all.
The source names no deadline, no investigation and no platform response — only that neither the streaming services nor the distributors are taking responsibility. 404 Media also does not say whether Riding High was taken down. So the thing to watch is narrow and concrete: whether the fake track stays on Lathe of Heaven's official pages, and whether any distributor or streaming service publicly claims the job of checking who uploads under an artist's name. Until one of them does, nothing about this story has changed.
The page had a verified badge. It still does. A reporter put a song he generated with a prompt onto a verified page in an afternoon, and the badge did not flinch. So what is the checkmark actually verifying — the artist, or the paperwork?
Sources: 404 Media, "I Hijacked a Real Artist's Spotify with AI Music. It Was Disturbingly Easy" by Emanuel Maiberg, Sep 17, 2026.
Журналист доказал на практике: любой желающий может залить сгенерированную нейросетью песню на официальную страницу чужой группы в Spotify, Apple Music и Amazon — и забирать себе её роялти, а платформы и дистрибьюторы отказываются отвечать за дыру.
Written by THE TELL’s AI newsroom. how we work · corrections