AI Cheating Threat Index: Q3 2026

Commercial invisible overlay tools are subscription software products with pricing tiers, customer support, and changelog updates. Their viability depends on continued access to LLM APIs, which is also their single point of failure under network-layer enforcement.

Every price below was read from the vendor's own pricing page on 2–3 September 2026. Four of the six had moved since our Q2 edition, in one case by a factor of eight. Where a vendor states two different prices on its own site, both are shown.

Reading the scores: individual tools below are scored 1–10 (threat score). Categories and the overall index are scored 1–100. The two scales aren't on the same axis; see Methodology for the weighting formula.

Every LockedIn AI price is displayed under a countdown timer; the list prices are shown first and the promotional prices in brackets. Ultracode AI states $799 on its homepage and in its checkout URL, and $899 on four product subpages; we report both rather than choose.

Four new entrants, and all of them arrived through the App Store

The six tools above are the ones we track in depth. Four more launched inside this quarter, and how we found them is itself the finding: none appeared on Product Hunt or Hacker News. We reconstructed 176 Product Hunt launches across July and August, and separately censused all 8,220 Show HN posts in the window. Between them they surfaced exactly one covert interview assistant — a browser-based tool that explicitly disclaimed stealth (“not a stealth tool”) and whose domain is now parked for sale. All four genuine entrants were found instead in Apple's App Store metadata, which publishes a real first-release date.

The same invisibility holds in the press. Across the quarter we found no named-tool story about interview cheating in any tier-one technology outlet — TechCrunch, The Verge, Ars Technica, Wired, CNBC and 404 Media were each swept and returned nothing in the window. The products that were named were named in HR trade press and in contributor columns, several of which sourced their prevalence figures from vendors that sell detection. A buyer relying on mainstream coverage to know what exists in this category will not learn it there.

We are not scoring these four individually yet. Three make no invisibility claim at all, none publishes a verifiable user count, and one is a version 1.0 released a week before this edition closed. They move the commercial category by a single point, on ease of access rather than on capability, and we will revisit them in Q4 with usage evidence rather than launch dates.

One near-miss we could not date. SkillCopilotAI advertises “completely invisible and undetectable in any online meeting software and online coding test platforms” at $28.90/month billed yearly, and names HireVue among its targets. Its first public trace is 14 August 2026, but its domain was registered in March, so we cannot establish it as an in-window launch and have left it out of the count.

Local LLM inference remains the threat vector that network enforcement alone does not reach. A candidate running Ollama, LM Studio, or a self-compiled inference server generates zero external network traffic. Their device calls no AI API. DNS queries to known AI providers are irrelevant, because none are made.

Through Q2 the practical constraint was hardware. Q3 removed a large part of it. On 10 August 2026 Meta released Muse Glimmer 30B under Apache-2.0 — a 30-billion-parameter dense, natively multimodal model with a 128K context window. Its 4-bit quantisation is a 16.76 GB file, and Meta's own description is that it is “small enough to run on a Mac or PC with a single consumer GPU.” It has been downloaded more than 620,000 times.

At the other end of the scale, Liquid AI's LFM2.5-2.6B ships a 1.59 GB quantisation the vendor reports running at 220 tokens/second on an Apple M5 Max and 30 tokens/second on a phone, in under 2.5 GB of memory. Note that despite being freely downloadable it is not Apache-licensed: the LFM Open License conditions commercial use on the licensee earning under $10 million a year.

Proxy exam fraud services operate as structured marketplaces: a client posts an upcoming exam, operators bid, and payment is released on successful completion. Pay-after-pass pricing removes financial risk for the buyer and creates strong performance incentives for operators. The ecosystem is most active in cybersecurity certifications, technical hiring assessments, and academic examinations.

Each defense is rated against the full threat landscape documented in Sections 1–6. “Bypassed” means a working, documented evasion technique exists and is accessible to any motivated candidate.

The macOS and Windows gap has inverted

The technique every one of these tools relies on is capture exclusion: marking a window so it is omitted from screen sharing and recording. On Windows this still works as designed. On macOS it no longer reliably does — Electron's own documentation now states that applications using ScreenCaptureKit “will capture your window despite calling win.setContentProtection(true), due to an intentional macOS change,” and two of the open-source projects independently describe their macOS invisibility as best-effort. The practical consequence is counter-intuitive and worth stating plainly: for this specific threat class, a macOS candidate is now somewhat easier to catch than a Windows one, which is the reverse of the usual assumption.

One more Q3 development belongs here. In August a small open-source utility appeared that does nothing but enumerate open windows and report which ones are excluded from screen capture, flagging them in red. Its author's stated rationale is that “some malware does it too, to stay out of recordings.” It is a hobby project of a few dozen stars, not a product. But it is the exact detection primitive this entire threat class depends on defeating, and it is now sitting in public.

Verdict legend: BYPASSED defense fails outright · PARTIALLY BYPASSED evasion exists but needs real effort · PARTIALLY EFFECTIVE catches some, misses a lot · NO KNOWN BYPASS holds under current threats. Full definitions in Methodology.

The Q2 edition of this index made five specific predictions about Q3. Two were right, three were wrong, and one of the wrong ones was wrong in a way that taught us more than the correct ones did. We publish the scoring because a quarterly index that never grades itself is marketing.

What we are watching for Q4 2026

• Whether remote-assist becomes a category. One vendor now sells hands-on remote control. If a second ships the same feature, this stops being a product decision and becomes the category's direction of travel.
• Whether macOS capture exclusion degrades further. ScreenCaptureKit already breaks the guarantee these tools rely on. If Apple extends that behaviour, the macOS half of this threat class weakens without any proctoring vendor doing anything.
• Whether the offline path reaches non-technical candidates. Local inference currently requires installing a runtime. The moment one commercial overlay bundles a local model as a default setting, the network-visible population of this threat drops sharply.
• Whether capture-exclusion detection reaches production. The primitive is public, and the ground is no longer unclaimed: a startup called InterviewWatch launched on 8 July 2026 specifically to detect AI assistance during live technical interviews. No established proctoring vendor has shipped the capability. The question for Q4 is whether any of them buys or builds it, or whether detection of this threat class stays with new entrants.