AI-generated album falsely attributed to Kumi Tanioka on Spotify

Kumi Tanioka, the acclaimed composer of Final Fantasy: Crystal Chronicles, has publicly denounced an AI-generated EP falsely attributed to her on Spotify. The incident underscores a growing vulnerability in how streaming platforms verify artist identities in the era of generative AI.

Tanioka discovered the EP, titled "A Village Built on Wind," linked directly to her official Spotify profile. Taking to X to address the discovery, Tanioka stated, "This album is definitely not something I made," while questioning whether the content was the work of another individual with the same name or the product of generative AI. Her publisher, Digital Sonic Design, later confirmed that the tracks were not her work. The publisher noted that the same songs are explicitly labeled as AI-generated on YouTube Music, confirming the synthetic nature of the audio.

The systemic gap

This incident is particularly notable because Tanioka is a verified artist on Spotify. Despite this status, the platform's systems allowed unauthorized content to be assigned to her profile, creating a direct link between a legitimate professional identity and synthetic media. Digital Sonic Design clarified that while the tracks do not technically infringe on Tanioka's copyright, the false attribution creates significant public confusion and misleads listeners regarding her discography.

Industry implications

The case highlights a critical failure in the verification systems of major streaming services. As generative AI makes it easier to produce high volumes of music, "ghost" albums and misattributed tracks are becoming more common. By attaching AI content to the profiles of established artists, bad actors can exploit existing visibility to gain streams or deceive the public. This trend raises urgent concerns regarding artist identity theft and the erosion of intellectual property rights, as the line between a creator's official body of work and AI-generated imitations blurs.

What remains

While the attribution has been debunked, the incident leaves open questions about how Spotify and similar platforms intend to prevent such occurrences. The fact that a verified profile could be compromised by a third-party upload suggests that current verification badges may be insufficient protection against systemic vulnerabilities. Industry observers are now watching to see if streaming platforms will implement stricter auditing for uploads linked to verified artist IDs to prevent further cases of identity exploitation.