← Back to blog

Hiring · 9 min read

How to Tell If a Candidate Is Using AI in an Interview

Divya Bhanushali · Chief AI Officer

August 6, 2026

Search for how to detect AI use in an interview and every result gives you the same list. Watch for a consistent three-to-five second pause before each answer. Watch for eyes scanning left to right instead of meeting the camera. Listen for answers that sound like documentation. Ask a follow-up question they cannot answer.

Every one of those tells works. They just work on the wrong person.

The tells all assume the candidate cannot do the job

Read the standard advice closely and a shared premise appears. The long pause exists because the candidate is waiting for a tool to produce something they could not produce themselves. The scanning eye movement exists because they are reading rather than recalling. The documentation-flavoured answer exists because they are relaying text they do not own. The failed follow-up exists because they never understood the first answer.

Each tell detects the same underlying thing: a candidate whose stated ability exceeds their actual ability by a wide margin. That gap is what leaks. The tells are proxies for it.

This is a real category of candidate and catching them has value. But it is not the category that should worry a hiring team most, and it is not the one driving the numbers.

AI does not make a 1 look like a 10. It makes a 6 look like a 10.

Consider a competent mid-level engineer. They understand the problem when they read it. They could produce a working solution given normal time. They know why the solution works and can explain the trade-offs, because they have made those trade-offs before.

Now give them an assistant that improves structure, recalls the optimal approach faster than memory would, and produces cleaner code than they write under pressure.

Nothing about their behaviour changes.

There is no pause, because they understood the question on sight. There is no scanning, because a glance is enough. There is no documentation-voice, because they rephrase in their own words as a matter of habit. The follow-up lands cleanly, because they genuinely know the domain.

A 6 performing as a 10 looks exactly like a 7. There is no behavioural tell, because there is no comprehension gap to leak.

The output is not a fraudulent answer. It is a real answer, slightly better than that person's true ceiling. Every signal the standard playbook watches for stays flat.

Why competent engineers are the ones under pressure

The intuition that cheating is for people who cannot do the work runs into the labour data.

In Canaries in the Coal Mine?, published November 2025, Stanford's Erik Brynjolfsson, Bharat Chandar, and Ruyu Chen analysed high-frequency payroll records covering millions of US workers. They found that early-career workers aged 22 to 25 in the most AI-exposed occupations saw a 16 percent relative decline in employment after generative AI adoption, while employment for more experienced workers in the same occupations held stable or grew.

Software development is one of the exposed occupations, and reporting on the study put the decline for developers in that age band at close to 20 percent against a late-2022 peak.

Read that as a description of who is sitting your interviews. The people squeezed hardest are not the unqualified. They are early-career engineers who can do the work, competing for a shrinking number of entry points, against a pool that has also discovered the tools. The pressure lands precisely on the competent-but-not-exceptional candidate, which is exactly the profile behavioural detection cannot see.

The tooling reflects the same reality. Cluely charges $19.99 a month for its standard tier, but the capability that hides it from meeting screen-sharing software sits in a separate $149.99 per month tier, per Cluely's own pricing page as of July 2026. Interview Coder now lists $799 for lifetime access. Nobody paying $149.99 a month to stay hidden is doing it casually.

What each behavioural tell actually catches

The right-hand column is the same person every time. That is the structural problem: these are not five independent checks, they are five measurements of one variable, and that variable is competence rather than assistance.

Follow-up questions deserve credit as the strongest item on the list. They test whether someone understands what they said, which is a genuinely useful thing to know and worth doing regardless. But understanding and assistance are different properties, and a test for one is not a test for the other.

The detection numbers describe suspicion, not proof

Survey data is often read as evidence that detection works. It mostly describes how often interviewers feel uncertain.

A 2026 Greenhouse survey found 91 percent of American hiring managers had encountered or suspected AI-generated answers during online interviews. Encountered or suspected is doing considerable work in that sentence. Separately, Fabric's analysis of 19,368 live interviews flagged 48 percent of candidates in technical roles for AI assistance, and found that 61 percent of those flagged would still have passed the interview. CodeSignal reported fraud on proctored coding assessments rising from 16 to 35 percent in a year.

Two things follow. Suspicion is now the default state of a technical interview, and the flag rate is high enough that acting on suspicion alone means rejecting large numbers of people on evidence that would not survive a challenge. Neither is a functioning control.

What to do instead

If the gap cannot be observed, stop trying to observe it. Two approaches hold up, and they work at different layers.

Change what the interview measures. Assume assistance is available and design around it. Ask the candidate to critique a flawed solution, extend their own code under a changed constraint, or explain why they rejected an alternative. These are harder to outsource in real time because they depend on context that only exists in the room. This costs you nothing technically and improves interviews generally.

Remove the conditions the tools require. Every category of assistance has a dependency it cannot discard:

• A hosted assistant has to reach a model over the network. Under a default-deny policy that resolves only interview-approved destinations, the request fails before a connection opens.
• A hidden overlay has to ask the operating system to exclude its window from screen capture, or it appears in the recording and stops being useful. On Windows that means the WDA_EXCLUDEFROMCAPTURE flag, and checking for it catches the technique regardless of what the process is renamed to.
• A model running locally needs neither of those, so it is identified by the GPU memory it occupies instead.

This is the layer Aiseptor operates at, and the reason is the argument above: enforcement does not require distinguishing a 6 from a 10, because it never has to judge the candidate at all. It changes what the device can do.

What this does not solve

Stating the limits matters more than usual here, because the whole point is that confident detection claims deserve scrutiny.

• It is not identity verification. Confirming a clean environment and confirming who is sitting the interview are separate problems.
• It does not tell you whether a candidate is good. It removes assistance from the measurement. Interpreting the measurement is still your job.
• It cannot see a phone in another room, a person off-camera, or a printed page. Network and OS enforcement covers the device, not the room.
• A locally loaded model is caught by GPU evidence rather than network policy. Anyone claiming network enforcement alone defeats local inference is overselling.

The honest summary is narrow. You cannot catch competent AI-assisted candidates by watching them, because there is nothing anomalous to watch. You can remove the tools' operating conditions, and you can ask questions that are hard to answer without context. Everything else is reading tea leaves and calling it a signal.

Aiseptor enforces interview integrity at the network and OS layer rather than by observing candidates: no webcam, no keystroke logging, no screen recording. See how it works, or read what it deliberately does not do.