Detecting Screen Overlays in Technical Interviews: A Guide

By Vaibhav Devere, Founder, Zero Assist · 2025-05-15 · 7 min read

How Candidates Use ChatGPT During Interviews

ChatGPT usage in interviews falls into three categories:

1. Pre-interview preparation The candidate studies common questions and AI-generated answers beforehand. This is difficult to detect but also less harmful — the candidate still needs to recall and adapt the material.

2. Mid-interview tab switching The candidate alt-tabs to a ChatGPT browser tab, pastes the question, and adapts the answer. This creates visible screen activity and timing anomalies.

3. Real-time overlay or audio tools The candidate uses a tool like Parakeet AI or Final Round AI that queries ChatGPT (or similar LLMs) automatically without manual tab switching. This is the hardest to detect without process-level monitoring.

Can ChatGPT Usage Be Detected

Direct detection of ChatGPT itself is difficult. Indirect detection of the method of access is reliable.

Detecting Tab Switching

When a candidate manually switches to ChatGPT:

  • Browser tab-switch events are visible to screen recording
  • The active window title changes to "ChatGPT" or "chat.openai.com"
  • Unnatural pauses occur before polished answers
  • The candidate's cursor may disappear from the IDE briefly

Detecting Overlay Tools

When ChatGPT is accessed through an overlay tool like Parakeet AI or Cluely:

  • The process-level detection targets the overlay tool, not ChatGPT itself
  • ChatGPT may appear as a background browser process or API client
  • Network traffic to OpenAI endpoints may be visible in some configurations

Detecting API-Integrated Tools

Some advanced cheating tools use their own OpenAI API keys to query GPT-4 directly. These:

  • Do not require the ChatGPT web interface
  • Show up as generic HTTP clients in network traffic
  • Are detectable only through process signatures of the intermediary tool

Behavioral Detection Methods

Even without technical monitoring, ChatGPT usage creates behavioral signatures:

Unnatural fluency with generic structure. ChatGPT answers tend to follow predictable patterns: "Certainly," "Let me break this down," "Firstly... Secondly..." Candidates repeating this register verbatim are likely reading AI output.

Perfect code on first attempt. Real engineers make mistakes. A candidate who types a complete, correct solution without a single typo, compilation error, or reconsideration is suspicious.

Inability to handle follow-up constraints. ChatGPT answers a specific question well. When you add an unanticipated constraint — "what if the input is 10x larger?" or "how would you handle a network partition?" — the candidate who relied on AI often struggles to adapt.

What Does NOT Indicate ChatGPT Usage

Avoid false positives:

  • Well-prepared candidates can sound polished without AI help
  • Non-native English speakers may use formal phrasing naturally
  • Experienced engineers often write correct code quickly in familiar domains
  • Nervous candidates may pause before answers for reasons unrelated to cheating

The Most Reliable Detection Layer

Process-level monitoring is the only method that definitively identifies whether a cheating tool — including those that query ChatGPT — was active during the interview window. It does not guess based on behavior. It reports what was actually running.

When combined with interviewer judgment and structured follow-up questions, this creates a detection system with both high sensitivity and acceptable false-positive rates.