A journalist showed how easy it is to upload AI-generated songs onto a real artist’s official Spotify page by abusing weak identity checks in digital music distribution. By claiming to be the band during a distributor signup/upload process, the uploader can publish fake tracks to major streaming services and collect royalties, damaging the artist’s reputation and confusing fans.
A journalist demonstrated how easy it is to publish AI-generated songs onto a real band's official Spotify page by exploiting weak identity checks in the digital music distribution pipeline. During the upload process with a distributor, the journalist simply typed in the name of an existing band. The distributor's system auto-matched that name to the band's verified profile. From there, the only barrier was a series of self-attestation checkboxes confirming the uploader was authorized to release music under that name. No proof of identity or rights ownership was required. Within a short time, the fake track appeared on the band's official page across multiple streaming platforms.
The attack succeeded because distributor onboarding workflows lean heavily on trust rather than verification. Checkboxes asking uploaders to confirm they are authorized are not backed by any identity or rights confirmation process. This gap lets anyone who knows a band's name attempt to publish content to that band's official presence. The problem is compounded for artist profiles that are not actively managed, since there is no one watching for unauthorized releases or catching them quickly after they go live.
This kind of impersonation can divert royalties away from the real artist and toward the fraudulent uploader. It also risks damaging the artist's reputation, since fans may associate low-quality or misleading AI-generated tracks with the band without knowing the content was never authorized. Streaming platforms and distributors have acknowledged that detection is difficult at scale, citing very high daily upload volumes and manual review processes that cannot keep pace, along with the added complexity of artists legitimately changing labels or distributors over time.
Defenders across the music industry, including artists, label operations, content moderation teams, and distribution managers, should take note of the following:
The underlying weakness here is not sophisticated hacking but a reliance on unverified claims during account and catalog management, a pattern relevant well beyond the music industry wherever platforms allow self-reported identity to control access to sensitive assets.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
By typing the artist's name into a distributor's upload form, the distributor auto-matched an existing verified profile, and the uploader simply checked boxes claiming authorization without any identity verification.
The workflow relies on self-attestation checkboxes rather than proof of identity or rights ownership, so anyone typing the correct band name could be matched to the real profile.
Profiles that are not actively managed are described as especially vulnerable, which increases risk for smaller or deceased artists whose pages get little attention.
Actively monitor and claim official profiles, use pre-release approval controls where offered, and establish a fast takedown process with distributors and streaming platforms.
“When Distrokid asked for my artist name, I typed in Lathe of Heaven.” And that AI track went onto the real band’s Spotify page. The trick is stupidly simple: type a real band name, click the auto-matched profile, tick a few ‘I’m authorized’ boxes… and the distributor ships your AI song to Spotify and others. No ID, no proof, nothing. Here’s the scary part: for less-managed or older artist profiles, this junk can just appear overnight. Fans see it on the official page, royalties go to the imposter, and your reputation takes the hit. Your move: make sure every official artist profile you touch has pre-release approval turned on, so nothing goes live on that page until someone on your team clicks approve.
The article describes real-world examples of unsolicited emails that claim to be sent by “AI agents,” pitching services, interviews, coverage, and paid work. It includes specific subject lines and message excerpts that show a repeatable workflow: automated outreach that tries to prompt recipients…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Scammers are approaching Céline Dion fans on Facebook and steering them into paying for “tickets” outside official resale channels. Victims may even receive a real-looking Ticketmaster transfer link, but scammers send the same ticket to multiple buyers so only the first person scanned at the venue…
A Cambodia-based scam network used ChatGPT to run multiple social-engineering schemes at once, including romance scams that pivoted into fake crypto/gold investments. The same operators also posed as online gambling reps offering fake winnings and as law enforcement demanding “fines,” using forged…
A real phone scam convinced an elderly woman that her drinking water was unsafe and pressured her into buying four overpriced “water filters,” costing about €4,000. The article also describes common Portugal-targeted scams, including “Hi Mum/Hi Dad, I lost my phone” money-transfer fraud and SMS…
Scammers on TikTok are impersonating resin artists by reposting stolen videos and telling viewers to “DM to order.” After moving the conversation into direct messages (and sometimes off-platform), they request deposits or full payment and then disappear, or they try to extract personal/banking…
