AI Bots Stole My Music

Philly folk duo Makeshift Hammer, whose music was stolen by AI and streamed on Spotify / Photograph by Kyle Cassidy

Two years ago, an unexpected notification on my phone derailed my day. A longtime listener of my band, Makeshift Hammer, sent us a DM with surprising news. “I just found an album on Spotify that sounds as if someone stole your shit and distorted it a bit,” they wrote. “I don’t really know what to do in these situations. … I’m sorry dude.”

The link they sent was to an album called Blue Road by an artist named Carey Dupont. I had never heard of Carey Dupont. And if you looked closely, the album art didn’t quite make sense: train tracks under a bifurcated overpass, being crossed perpendicularly by a trolley or bus. Dupont had no other releases that I could find and was seemingly otherwise unknown to the internet.

Makeshift Hammer is Philly’s premier mandolin–bass guitar–junk percussion gutter-folk duo, which is a fancy way to say we know a thing or two about being unknown. My bandmate, Bobby, and I have been playing together for a dozen years, first under the name Driftwood Soldier, now as Makeshift Hammer, and we’ve always worked other jobs — I’m a private detective — to support ourselves. We tour in a 2008 Honda Fit and sell thrift store dollar-rack T-shirts stenciled with spray paint as merch, but even with our overhead lower than the ceiling of a South Philly basement show, the market for strange bass-heavy story songs is unforgiving. We make this music because we don’t mind being the odd ones out, and because somewhere along the way someone forgot to teach us how to quit.

But Carey Dupont seemed even more off the grid than we were. They had no website, no social media, no dead ticket links to past shows, no profiles in alt-weeklies. Nothing except Blue Road, the album, on every streaming service.

The names of the songs on the album were mostly nonsensical, but very familiar to me. Dupont had tracks called “All My Friend,” “Bankers and Liars,” and “If Not Obvious.” We have songs called “All My Friends,” “Banker and a Liar,” and “If It’s Not Obvious.” The title track was “Blue Road”; we have a song called “Blue Way.”

The music was ours too. Not covers of our songs, but the actual recordings from our albums. The songs had been slightly slowed down or sped up, which distorted the sound, but they were still easily recognizable.

Carey Dupont was a scam.

An important thing to mention about Makeshift Hammer is that our most popular song is a revisionist retelling of the story of John Henry, the railroad folk hero who worked himself to death proving that he could outpace the machine sent to replace him. Listening to the digitally altered sound of my own voice playing back at me under a different name, I felt the space between my own experience and the story I’d retold a thousand times start to shrink.

But why? John Henry didn’t race the steam drill for fun; he was put in that position by coldhearted railroad bosses exploiting a racist economy to squeeze maximum profit from their workers. We’re a DIY gutter-folk band with more side hustles than Instagram followers. Who would bother making a machine to replace us, and how could gutter-folk music possibly make them any money?

The fear that Carey Dupont would replace us wasn’t just some abstract notion; in the year before we found it, the tracks on Blue Road had been listened to close to 50,000 times each. By contrast, many of the original recordings had only 1,000 to 2,000 listens despite being released four years earlier. Someone was using our music to play the streaming game and was massively outperforming us.

We shared a video about the scam on social media, and the reactions were immediate.

“It seems like there has to be some way y’all can get it taken down, right?” asked a local listener. “The theft is so blatant.”

“If those 40,000 listeners are real, how can you make ’em yours?” asked a friend in New Orleans.

“It’s a pretty weird thing!” said a friend in Washington. “ ‘Carey Dupont’ may be a bot?”

Even just a couple of years ago, that suggestion, that we were up against a machine, still had a conspiratorial edge to it.

“This will sound insane, but it might be AI,” said a musician from New York.

A response from Katie Feeney, a Philly musician who performs as Roberta Faceplant, showed we weren’t alone.

“I’ve been through this. I feel your pain,” she said, confirming, at least, that we were not alone. “I’m still trying to get [the copies taken] down.”

My own reaction was more complicated than I would’ve expected. I was angry, sure, but I also felt a surprising surge of validation that I didn’t expect. Maybe we weren’t bad at music — we were just bad at marketing! Perhaps the only thing standing between us and half a million listeners was our lack of business savvy!

I would’ve told you that I didn’t believe in the myth of meritocracy, but somewhere along the way I had still internalized the tech industry’s blithe assurances that their new platforms were level playing fields whose algorithms would sniff out any art and music deserving of viral success. Here I had the closest thing to an AB study you could ask for outside of the lab. (After all, we were using the same recordings.) If someone else could make a living with our music, when we were struggling to do so, I wanted to know who, how, and why.

So I started to look for answers.

Carey Dupont’s profile didn’t offer a lot of information, but the streaming numbers themselves were a place to start. Why were all the songs on Blue Road so popular? A well-known casualty of Spotify’s glorification of playlists is the very idea of the album as an artistic whole. Only dinosaurs of the CD age will open the streaming platform and play an album start to finish. Everyone else hears the most algorithmically preferred single when it appears on an automatically generated playlist. This typically leads to wildly uneven listening numbers across an artist’s catalog. As I write this, for example, our track “John Henry” has the same number of listens this week as our 15 least popular songs combined.

By contrast, Carey Dupont’s most popular track currently has 70,668, their least popular 62,202, with the other eight somewhere in between. That consistency suggests that people are listening to the album from start to finish over and over again, and because that’s not how real people listen to music on Spotify, I concluded that these listeners weren’t real people.

That fake listeners can be used to inflate an artist’s statistics will be no surprise to the musicians out there whose DMs are full of messages offering “10,000 REAL followers on Spotify for only $9.99.” Just this March, a musician named Michael Smith pled guilty to defrauding streaming services out of $8 million by having fake listeners play music — his own and AI-created — on repeat. Given the tiny fractions of a penny that streaming services pay artists for each listen, getting to that kind of total payout requires a vast number of streams, which means bot farms.

In our case, they’d skipped the step of making the music by taking our recordings, altering them the bare minimum to avoid easy detection by services like Gracenote’s MusicID (which uses track length as an easy digital fingerprint), and repackaging them with lazy near-miss titles and AI imagery before cranking out the automated listens. The songs on Blue Road have, by now, collectively passed 650,000 listens. Online royalty estimators suggest that number of listens would pay out around $1,600 to $2,600. Not a huge heist, but rinse and repeat over a few hundred low-profile bands and you have a living wage, without the 10-hour drives between gigs and venue merch cuts faced by actual musicians.

Any variation in the listens among the tracks was likely because Spotify’s algorithm was encouraging real humans to listen to this apparently popular band, which was infuriating, but wasn’t immediately harming our bottom line. Wasn’t the money made by the scammers coming from Spotify? If so, couldn’t the mysterious Mx. Dupont be something of a digital Robin Hood? Who among independent musicians feels the least bit charitable toward a company that compensates artists somewhere between $0.003 and $0.005 per listen?

But no: Unfortunately, streaming payouts are structured so that even though Carey Dupont was paid by Spotify, the money came from the pockets of artists like us. The reason Spotify’s per-stream estimate is so imprecise is that it doesn’t represent a fixed payout for each listen, but instead what the company calls a “streamshare.”

Spotify makes that sound simple in one of several pages on its website where it touts the platform as artist-centric. “Artists get paid based on their share of total streams on Spotify. If your music accounts for 1 percent of all streams, you get roughly 1 percent of the royalty pool.” Which is bad news for us, if it means we’re splitting that royalty pool with scammers using our own music.

Liz Pelly, author of the bestselling book Mood Machine: The Rise of Spotify and the Costs of the Perfect Playlist, explains that Spotify’s system “may seem simple enough, but the number of factors shaping every step of that equation is dizzying.” These include the subscription level and country of origin of the listener, but also, critically, any individualized rates worked out with the labels or distributors providing the music to Spotify.

Let us take Spotify at its word, though, and ignore the many ways the equation isn’t as straightforward as it says. In our case, imagine if the royalty pool had only the lifetime listens of Carey Dupont (650,813) and the original 10 Makeshift Hammer songs that account copied (40,552). The existence of Carey Dupont has made the total number of streams 17 times greater, but Spotify’s total payout won’t change, because it’s not based on the streaming numbers; it’s based on the company’s revenue. That means the only difference is that the same total payout, which would have been 100 percent Makeshift Hammer without the scammer, will now be allocated between the two artists proportionally, with 94 percent of the “streamshare” going to Carey Dupont and only six percent to us. This royalty structure allows Spotify to pass off the true costs of scammers to artists rather than pay for its inability or unwillingness to monitor its own platform.

Ducking the real financial consequences of the model is apparently how Spotify can afford to offer most of the recorded music in the world for immediate consumption at any time at the suspiciously reasonable price of $12 a month.

I was busy when all this started, taking cases as a detective and fighting the long, slow battle of rebuilding a 100-year-old West Philly twin room by room. It was unclear how many actual humans were mixed in among the bots inflating Carey Dupont’s numbers, but the apparent use of automation erased the unexpected ego boost of seeing songs I was proud of finding an audience, even under someone else’s name. Once I realized that the scammers didn’t have a magic answer to the question of how to make a living as a gutter-folk musician, “deal with that Spotify scam” dropped to the bottom of my to-do list.

Six months later, it happened again.

A different listener reached out with a link to an album by a new artist: Powerful Thinking by Hayden Donne. They had been listening to a playlist Spotify generated based on our song “Rosalee,” and something came on that sounded familiar, but wrong. Once again, Donne had no other music online and an obviously AI-generated album cover. Again the songs were minimally altered and renamed: “Believe” became “Trust,” “The Rapture Song” was shortened to “Rapture,” and the traditional “David’s Lamentation” became “Davis Sigh.” This time, however, our music made up only half the album, mixed together with another artist’s epic pop anthems in a clash of genres that would have given any human listeners whiplash.

/ Photograph by Kyle Cassidy

Our six stolen songs on Powerful Thinking generated more than 235,000 streams before the album disappeared from Spotify. My guess is that the other band involved found the album too and filed the necessary complaints.

Hayden Donne’s disappearance made it clear that filing a takedown notice against Carey Dupont was possible, but the fact that that would then be the end of the matter infuriated me. The odds of someone who recognized our recordings hearing these tracks were small enough that by the time we were alerted, the damage was long since done. Working artists’ streaming shares had already been paid to scammers by Spot­ify with a shrug.

I also knew that if the album was taken down, I might miss my only chance to find out more about the scammers and the systems that allowed them to thrive.

So instead, I reached out to David Post, a legal scholar specializing in intellectual property and cyberspace who taught at Temple’s Beasley School of Law. Post, conveniently, is also an avid musician whose duo, Bad Dog, discovered songs from a forthcoming album on streaming platforms under the names of fake artists, as documented by The New York Times in 2024. I asked him, based on his knowledge and his own experience, what he thought our options were.

“We thought about suing,” he told me. “We thought pretty hard about it.”

Post wasn’t thinking about suing Spot­ify, though — he was considering going after the digital distributor, Level Music, which had provided the fraudulent recordings to the streaming platforms. Digital distributors are services like DistroKid, TuneCore, and The Orchard that are paid by artists to put their songs on digital platforms like Spotify, Apple Music, and YouTube. As someone who had been part of digital copyright debates since their inception, Post felt that distributors likely had more legal liability because he knew they would have been contractually obligated to certify that the material they were sharing didn’t infringe on the copyrights of others.

Bad Dog ultimately decided a lawsuit was more work than they could take on, even though both bandmates were lawyers. Post suggested that the only form of legal action with a strong enough incentive would be a class action lawsuit. “As a practical matter,” he said, “that’s the real legal resource.”

With this in mind, I went looking for the distributors of Carey Dupont’s and Hayden Donne’s albums. On most platforms the only copyright/label/distribution information was the fake artist’s name. In several cases, Hayden Donne’s composer credit was shared with a “Winston Wood,” but that name also led me nowhere. Running out of options, I searched down Reddit threads, ending up on a dubious Discord server where “credits” bought with cryptocurrency could purchase a bot-assisted scrape of Spotify’s metadata. (Yes, I went to the bots to help me find the bot farm.) The searches revealed that both scam artists were distributed by SoundCloud, an enormous streaming platform in its own right, better known among musicians for the fact that artists can easily use it to post their music directly.

In fact, SoundCloud had featured prom​inently in David Post’s story, since he believed that’s where the scammers got the recordings from his unreleased album. We too had used SoundCloud to post private preview versions of our albums, and now it seemed possible that that was where our recordings had been copied.

A takedown notice to the distributor, SoundCloud, should, in theory, remove Carey Dupont from all platforms, but for good measure I prepared a separate notice to Spotify. I consulted templates and cross-checked them against the list of required information provided by both platforms deep in the legal sections of their websites. I acquired an official authorization from my bandmate, with whom I share the recording rights, to act on his behalf. I provided detailed personal information that the Spotify legal page warned me they might pass along to the very scammers I was trying to stop. I created tables with all the available information about the original tracks and the copies. I begged lawyers I know with unrelated specialties to glance at it and tell me if they saw glaring mistakes. In both notices, I requested Carey Dupont’s termination, but also all identifying information that entity could provide on the scammers.

SoundCloud immediately responded with an automated message asking me for the precise information and legal language I had just sent them. Several days later they kindly followed up with an automated survey to gauge my experience with their customer service. They neither sent me the information I requested nor took down the music. From Spotify there was nothing but silence.

In Mood Machine, Liz Pelly writes about the way that Spotify has flattened the music industry, forcing independent and DIY artists to compete in the economies of scale designed for arena-filling pop stars. The same principle holds true for bureaucracy. Major labels have legal departments; gutter-folk duos do not. Or as Katie Feeney, the Philadelphia musician with a similar experience, described, the scammers are “targeting artists that are small and under-resourced enough to give up the fight.”

Figuring out the mundane intricacies of a takedown notice is just one of many tasks that make up “being a musician” that have absolutely nothing to do with music. What frustrated me the most, though, was that all that work would barely accomplish anything. What are the chances they would retroactively recalculate the royalty pool? Why couldn’t the same thing happen to us again tomorrow? If anything, I was doing Spot­ify’s cleanup work for them, pointing out evidence that the system isn’t working for small artists, so they could make that evidence go away.

If any of this was on a human scale, the platforms could have found creative ways to use their substantial power to make it up to us. Maybe SoundCloud could send us any money they made distributing our stolen songs? Perhaps Spotify could recommend our actual music to any user who streamed a Carey Dupont song? I sent Spotify’s legal department a follow-up email suggesting it. More silence. (Requests for comment for this story to Spotify and SoundCloud also went unanswered as of press time.)

My last recourse to identify the scammers was a provision in the Digital Millennium Copyright Act allowing me to request a subpoena from the district court for identifying information from the streamers/distributor. The catch is that I have to swear to use the information only to protect my copyright, so even if it’s granted, it might not allow me to name them publicly.

My takedown notices have been sent to Spotify and SoundCloud. My subpoena request has been sent to the district court. Carey Dupont is still available on Spotify.

Soon after the rise and fall of the fictional Hayden Donne, my duo made a big decision. We were still Driftwood Soldier at the time and had been playing under that name for 12 years, but after the abrupt cancellation of all touring in 2020, we had slipped into a semi-hiatus. We continued playing around Philly, and occasional dates up and down the East Coast, but hadn’t released more than a few singles. Now we were working on a new album and planning more time back on the road, but we wanted our return to be under a new name: Makeshift Hammer.

The trick was to make sure our listeners knew that Makeshift Hammer wasn’t just another Carey Dupont or Hayden Donne, passing off old Driftwood Soldier recordings as their own music. Our solution was to record and release a new song with our old name. “Driftwood Soldier,” the song, would be our first release as Makeshift Hammer. It would be a symbolic way to pass ourselves the baton. Anyone who cared would know that we were still us.

But last summer, while we were in the studio recording “Driftwood Soldier,” further concerning developments appeared on the horizon. Spotify’s most recent viral pseudo-folk band, the Velvet Sundown, had been revealed as nothing but a mashup of AI-generated music accompanied by AI-generated images of imaginary bandmates with AI-generated backstories. That they quickly gained a million followers on the platform showed how happy Spot­ify was to replace human artists with less troublesome cogs. As the fall wore on, news trickled in about an AI country song topping Billboard’s charts. Warner Music Group pulled a 180-degree turn, trading a $500 million lawsuit against AI music generator Suno for a licensing deal. The titans of the music industry were pivoting toward automation.

AI band The Velvet Sundown

The major labels have the leverage to negotiate premium royalty rates with Spotify. Independent artists get the opposite treatment: a program called Discovery Mode through which they can accept an even lower royalty rate for playlist exposure. Pelly’s book documents Spot­ify’s further experiments commissioning its own music to pad out popular playlists with low-royalty material. It’s not hard to imagine a future in which such “ghost artists” become fully automated, like the Velvet Sundown. Why pay real musicians when AI songs can occupy any inconvenient holes in the playlists between major-label heavy hitters? Never mind that those same few holes were the ones we were promised might let smaller acts (like certain mandolin-bass gutter-folk duos) sneak past the gatekeepers.

Post, the lawyer, pointed out that with recent developments making AI-generated songs so accessible, the scams we experienced just a year or two ago — scraping and changing our songs — already seem quaint. “What happened to us is going to be seen as very primitive,” he said. “They actually had to copy stuff!” Even more than Carey Dupont’s automated listeners, the news of the Velvet Sundown sounded like a steam drill coming down the tracks.

There are obvious and important ways in which I’m not like John Henry. I’m a white musician in the 21st century, while the inspiration for his story is commonly believed to be a Black man who was born a slave. Both then and now, the effects of automation are unequal. On a recent episode of the Yallidarity podcast, musician Lizzie No laid out the particular risk to Black artists when their likeness and art can be easily appropriated by anyone with the right app.

“Culture is this place where we have been able to tell our story in our own words and our own rhythms,” No explained. “For me that’s why it’s so frightening when the distinction between real music and real musicians and AI gets so blurred.”

The steam drill didn’t want John Henry’s job. Carey Dupont and the Velvet Sundown don’t want mine. They’re just machines. It’s the human beings behind these machines who don’t care about the livelihoods of working people, much less the unfathomable power of music to connect human beings. Those profiteers don’t care that AI music isn’t actually cheap. They don’t mind that the data centers fueling their large language models — echoing other tech innovations before them — have huge costs in energy, emissions, and water usage that future generations will be paying for. Like Spotify, they’re more than happy to pass the true costs of their business off to anyone and everyone else.

Our song “John Henry” differs from the classic version of the tale in that John Henry doesn’t die racing the steam drill. His fatal heartbreak occurs immediately after, when he realizes that winning the race hasn’t saved the jobs of his fellow workers; it’s just earned him a place on a new crew of steam drills, and the right to race them every day after until he can no longer keep up.

If musicians are offered the same deal, they might not die of heartbreak, but they might very well give up, robbing the world of their music, and for what? To squeeze a little more money from the bottom 99 percent for the sake of a few streaming executives?

Makeshift Hammer isn’t a household name unless we’ve played in your basement. We’re just two humans trying to carve out a living with music, in a world where the value of humans and the value of music dangle precariously. This past winter, we got ready to finally release “Driftwood Soldier” by Makeshift Hammer. Our new song with our old name. Our first single in four years. The resurrection of a DIY music project in a changed landscape. A humble request to the Instagram feeds, Spotify playlists, and Gmail spam filters that rule us all to at least let longtime followers hear about our new name. And then we got one final unwelcome surprise.

A friend, looking for our lyrics on the internet, had come across a funny thing. There was already a song called “Driftwood Soldiers” on Genius lyrics that had been released just six months ago by a new band. A very new and very popular band called the Velvet Sundown.

Published as “Bots Stole My Music” in the July 2026 issue of Philadelphia magazine.