How to Spot AI Cheating in Technical Interviews: A 2026 Recruiter Playbook

48% of tech candidates show AI-cheating signals in 2026 interviews and 61% of those who cheat clear the pass bar. Here is the tool taxonomy, the six live signals that catch it, and the structural fix recruiters can ship in 30 days.

Across 19,368 interviews logged between July 2025 and January 2026, 38.5% of candidates were flagged for AI cheating behavior — and the number climbs to 48% on purely technical roles (Fabric, 2026). The harder stat: 61% of those cheaters score above a 7.0 hire threshold and would have advanced without detection.

This is not a candidate-quality problem. It is an interview-format problem. A wave of tools — Cluely, Interview Coder, Leetcode Wizard, Ultracode — render LLM answers in an invisible OS-level overlay that Zoom, Teams, and Meet cannot capture. The interviewer sees a clean IDE. The candidate reads the answer off-screen.

If you run remote technical interviews, the question is no longer "is AI cheating in interviews happening on my pipeline?" — it is happening, on roughly half of your tech reqs. The real question is which signals you train interviewers on, and what structural changes carry weight when live coding becomes a coin flip. This post is the recruiter playbook for both. The companion read on the resume side is the AI resume flood and how to fix it.

The 2026 cheating-tool taxonomy

Four tools dominate the technical-interview cheating market. They all share one trick: they hook into the OS graphics layer (DirectX on Windows, Metal on macOS) and render an overlay above the GPU output but below the screen-share capture. The interviewer sees nothing. The candidate sees the LLM.

Tool	What it does	Tell-tale
Cluely	General-purpose meeting copilot; transcribes the prompt and serves an answer overlay	Founded 2025 by Roy Lee + Neel Shanmugam after Columbia suspension over Interview Coder. $5.3M seed → $15M Series A from a16z; $7M ARR claim later retracted (TechCrunch, 2026, Fortune)
Interview Coder	Specialized in LeetCode-style problems; humanized explanations to talk through	The original. Got Lee suspended from Columbia
Leetcode Wizard	~$49/mo, real-time suggestions, complexity analysis, "say it naturally" coaching (leetcodewizard.io)	Optimized output paired with rehearsed cadence
Ultracode	Cross-platform invisible mode	Bypassed CoderPad, HackerRank, and CodeSignal in April 2026 enterprise testing (Cybersecurity News, 2026)

The Fabric breakdown of how candidates cheat in technical interviews: 45% use dedicated assistants like Cluely or Interview Coder, 34% use voice-mode ChatGPT or Gemini, 18% use the old methods (tab-switching, secondary screens), 3% rely on live human help (Fabric, 2026). Juniors (0–5 YoE) cheat at roughly double the rate of seniors. Sunday is the highest-volume day, at 47.1%.

Six live signals interviewers should watch

Karat's engineering team — which conducts ~300,000 interviews a year — published a six-signal framework that holds up well against the 2026 tool wave (Karat, 2026). Train interviewers on these and the catch rate climbs without buying anything.

The 3–5 second pre-answer silence. Voice-mode LLMs and overlay tools all introduce a latency floor. A candidate who pauses ~4 seconds before every substantive answer — and never before pleasantries — is reading.
Eye-gaze drift. Reading left-to-right off-camera, not at the interviewer or at their own IDE. Cluely overlays anchor in a fixed screen region; the eye motion is rhythmic.
Instant optimal solution with no iteration. Real engineers explore. They write a brute-force pass, name a tradeoff, then optimize. An immediately optimal solution with no scratch work is the single strongest signal.
Explanation-code mismatch under follow-up. Ask "why this library and not the standard one?" or "what happens if n=0?" If the candidate cannot defend the code they just wrote, the code was not theirs.
Code blocks materializing instantly. A 40-line solution that appears in a single keystroke burst with inconsistent variable naming. Real typing has rhythm; pasted code has none.
Edge-case blindness on "perfect" code. A candidate who delivers an O(n log n) sort but cannot describe what happens on empty input or duplicate keys did not write it.

Two of these (#1 and #5) can be partially automated by proctoring platforms. The other four require a human interviewer who is paying attention. That is the leverage point. The fuller signal map sits inside the broader AI candidate screening discussion.

Why proctoring is losing the arms race

Buy-side platforms keep shipping detection. Sell-side tools keep evading it. The treadmill is real.

HackerRank rolled out AI proctoring in July 2025 — web activity monitoring, plagiarism detection, image analysis on webcam (HackerRank, 2025).
CoderPad tracks code paste events, browser focus, and uses ML on solution similarity (CoderPad Docs).
Fabric stacks 20+ behavioral signals and claims an 85% detection rate (Fabric, 2026).

Then a single tool — Ultracode — bypassed all three platforms across Windows and macOS in April 2026 testing (Cybersecurity News, 2026). Worse, none of these tools touch the long-tail cheats that never enter the browser: a second device next to the keyboard, a phone teleprompter, a noise-cancelled friend on a third call.

Proctoring is a useful floor, not a ceiling. Anyone selling 100% detection is selling next quarter's bypass.

The structural fix: validity-backed interview redesign

The fix is older than the problem. Schmidt & Hunter's 85-year meta-analysis of selection methods — re-validated by Sackett in 2021 — gives concrete predictive-validity coefficients (Sackett 2021, Plum summary):

Method	Predictive validity
Unstructured interview	0.20
Years of experience	0.18
Structured interview	0.42
Work sample test	0.54
GMA + work sample	0.63

Three concrete swaps for any loop currently leaning on a single live-coding round:

Replace one LeetCode round with a paired live-debug on the candidate's own past code. They open a project they've shipped, walk through a commit, and you ask them to extend it. There is no LLM to overlay because the answer requires their history.
Add an async work sample with an oral defense. The candidate solves a take-home over 48 hours; the next round is a 30-minute conversation where they reason through their own code. Karat's framework lists "structured problems emphasizing reasoning over execution" as the single strongest defense — "live interviews are still the strongest defense against cheating" (Karat).
Run conversational follow-ups after every code answer. "Why this approach instead of the standard library?" "What's the failure mode at scale?" The latency of prompting an LLM and reciting an answer exposes the cheat naturally — and even when it doesn't, the candidate who passes those questions is the candidate you wanted anyway. For the full funnel impact, see engineering recruiting benchmarks 2026.

Move the signal upstream: evaluate on real work

The deeper move is to stop treating the interview as the primary signal. The interview is now compromised. The artifacts a candidate has actually shipped — public commits, papers, conference talks, OSS pull requests, side projects with traction — are not.

The questions that work in 2026:

"Walk me through this commit from your repo. What broke before you wrote it?"
"You shipped this library. Why this API shape and not the obvious alternative?"
"You have a talk on X. What's the part of X you got wrong the first time?"

Two things happen. First, the cheat surface collapses — there is no live problem for the LLM to solve. Second, you are scoring the candidate on what they have already proven, which is what the validity research said you should have been doing all along. This is the bet imast is built on: the evaluation layer scores candidates on real work history and project signal, and live-test performance becomes a tiebreaker, not the primary input. Try the candidate evaluation flow at /chat.

A 30-day interview redesign checklist

Concrete, copy-pasteable. Run this whether you buy any proctoring tool or not.

Week 1 — audit. Log every technical round across your last 20 reqs. Tag each as: live-coding-only, live-coding + follow-ups, work sample, real-work walkthrough. Count the share of live-coding-only.
Week 2 — add one work sample. Pick the most leveraged role and add a 48-hour async take-home with a 30-minute oral defense. Track outcomes against the old loop.
Week 3 — train on the six signals. One-hour workshop for every interviewer. Use real recordings (anonymized) of obvious tool use. The 3–5s silence and the instant-optimal-no-iteration are the two that stick the fastest.
Week 4 — refresh the question bank. Any question older than 90 days is in the Leetcode Wizard training set. Refresh monthly going forward.
Ongoing — drop screen-share as your integrity layer. It is theatre against modern overlay tools. Keep it for collaboration, not detection.

Three takeaways

Live coding is now a coin flip. 48% of tech candidates show AI-cheating signals; 61% of cheaters pass.
Detection is a treadmill. Buy proctoring as a floor, not a ceiling. The arms race favors the cheaters.
Structural redesign wins. Work samples, oral defenses, and real-work walkthroughs are validity-backed and overlay-proof.

If your loop still hinges on a single live-coding round, you are not selecting for engineering ability in 2026. You are selecting for whoever installed Cluely first. See how imast evaluates candidates on real-work signal →

FAQs

Q: Can proctoring software actually catch tools like Cluely? A: Sometimes. AI proctoring from HackerRank, CoderPad, and Fabric catches most browser-tab cheating and some webcam tells, but Ultracode bypassed all three in April 2026 testing. Treat proctoring as a noise filter — it raises the cost of cheating but doesn't prevent it.

Q: Is asking candidates to share their full screen enough? A: No. Modern AI cheating in interviews uses OS-level overlays that render below the screen-share capture layer on both Windows (DirectX) and macOS (Metal). The candidate's shared screen looks clean to you while the LLM answer sits invisibly on their local display.

Q: Are async work samples legal under EEOC and Title VII? A: Yes, when they are job-related and consistent with business necessity. Work samples have decades of validity research behind them (Schmidt & Hunter, Sackett) and tend to have lower adverse-impact ratios than cognitive tests alone. Keep the rubric documented and apply it uniformly.

Q: How fast are these tools spreading beyond engineering? A: Fabric's data shows sales roles at 12% cheating — a quarter of the tech rate but climbing fast as voice-mode LLMs improve. Customer-facing and analyst roles will follow within 12 months.

Q: Should we just go back to in-person interviews? A: Some companies (Google reportedly among them) are adding in-person final rounds for senior engineering hires. It works as a verification step but is expensive and slow. A structural redesign — work sample + oral defense + real-work walkthrough — gets you most of the signal without the logistics tax.

Q: What's the single highest-leverage change I can make this week? A: Add a conversational follow-up requirement to every coding round. After any solution, the interviewer asks two questions about tradeoffs, edge cases, and library choice. Costs nothing, takes five minutes per round, and exposes most overlay-tool users immediately.