404 Media lands a Udio track on a real band’s DSP pages via a self-attest distribution loophole

Lead: a verified page, without the band’s knowledge

On 17 September 2026 Emanuel Maiberg of 404 Media reported that a Udio track titled Riding High appeared on Brooklyn band Lathe of Heaven’s verified Spotify page without the band’s knowledge. The same article says it also landed on the band’s Apple Music, Tidal, and Amazon Music pages, and showed up as a 10 September release. Engadget (Lawrence Bonk, same day) repeated the report.

Background: self-attest matching. Not the UMG lawsuit

404 Media writes that the reporter signed up for DistroKid (the article states $3.75 a month), typed Lathe of Heaven as the artist name, and that DistroKid auto-found the existing Spotify, Tidal, Apple Music, and Amazon pages and asked whether that was the band — then attached the upload on a self-attestation. The cover was made with ChatGPT. 404 says the loophole predates AI slop and is now widely abused at AI scale.

This is not the 15 September 2026 Delaware complaint by UMG Recordings and Capitol entities against DistroKid companies for deceptive trade practices and copyright infringement. The themes sit next to that filing. They are not the same case.

404 Media reports that Odette Child began tracking in July and found more than 300 AI tracks impersonating names from Taylor Swift to deceased jazz players to non-musician celebrities. Engadget also uses “more than 300.” That figure is Odette Child’s tally, not a DSP or court count. Spotify’s for-artists blog (15 March 2026, updated 9 September) describes Artist Profile Protection as optional limited beta. Engadget still calls it limited beta as of 17 September. Engadget says Spotify told 404 that “profiles that aren’t actively managed can be especially vulnerable.” Engadget’s “about 50,000 AI tracks a day” is labeled estimated, so it is omitted here.

What this changes for producers

For commercial AI music going to YouTube, games, or streaming, the fact that moved is not whether a model is allowed. It is whose name the distributor stamps onto DSP pages.

• Identity checks: self-serve can land on an existing verified page from a name plus a checkbox. Even on a legitimate own-name upload, ask how the distributor decides to match an existing artist.
• DistroKid / self-serve risk: 404’s reproduction used DistroKid. The gate was self-attestation. That is not UMG’s masquerading-volume complaint, but distributor identity pressure points the same way.
• Watch your own DSP pages: a Spotify verified badge does not mean Artist Profile Protection is on — that tool is still limited beta. Apple, Tidal, and Amazon are separate. Check catalogs for tracks you did not send.
• Royalty diversion: 404 writes that stream money goes to the uploader. A fake under your name does not pay your account. Treat Odette Child’s 300+ as their watch-list scale, not an official census.

Sources

404 Media (Emanuel Maiberg, 17 September 2026); Engadget (Lawrence Bonk, same day); Spotify for Artists (Artist Profile Protection, 15 March 2026, updated 9 September). Clickable URLs are in the source list at the end of the article.