How does InterviewWatch detect AI use in a remote interview?
It combines operating-system evidence that is difficult for screen sharing alone to show: known AI applications and browser titles, newly observed AI-service network lookups on Windows, capture-excluded overlays, remote-control software, clipboard-event size, focus changes, device changes, and typing or answer-timing patterns. The system records which signals appeared and when. It does not read the candidate's prompts, answers, screen, or clipboard content.
An AI process running can be relevant evidence, but it does not by itself establish how the process was used. The interviewer must compare the incident timeline with the interview format, disclosed rules, and other evidence.
Fourteen detectors, grouped by the question they help answer.
The exact low-level implementation differs between Windows and macOS. The report uses stable, human-readable categories so reviewers do not need to interpret raw operating-system events.
AI and knowledge assistance
- Known AI desktop processes and local LLM runners.
- AI-related browser window titles.
- New AI-service DNS entries visible to the Windows resolver.
- Knowledge-source activity such as documentation or coding-reference sites.
Hidden or external control
- Windows excluded from normal screen capture.
- Remote-control host or viewer software.
- Injected input and unusual focus transitions.
- Agent heartbeat loss or interruption.
Environment and behavior
- Virtual camera or audio devices in active use.
- Monitors added or removed during the session.
- Large or structured clipboard events, without content.
- Uniform keystroke timing and pause-then-burst answer timing.
- Expected meeting-platform context.
From consent to a reviewable report.
A prioritization aid, not an automated verdict.
Each incident category has a configured severity contribution. Duration and repeated observations can change the contribution for signals that persist. Context-only events, such as an expected meeting application or a multi-monitor baseline present before the interview, can remain informational rather than deductive.
The server recomputes the final score from the stored timeline instead of trusting a number sent by the desktop agent. This makes the report reproducible from the evidence it contains.
Interpretation rules
- One signal is not treated as proof of cheating.
- Informational baselines are separated from risk events.
- Reviewers see timestamps, category, severity, and context.
- The report should be compared with the employer's disclosed policy.
- No candidate is automatically rejected by the product.
What is observed, and what is deliberately excluded.
Signal category, relevant process or window category, timestamps, duration, display and device changes, focus events, clipboard-event size, timing statistics, network-resolution categories, and heartbeat status.
Screen pixels, screenshots, screen recordings, webcam video, microphone audio, meeting audio, typed text, clipboard contents, private file contents, or the semantic content of answers.
What InterviewWatch cannot reliably conclude.
Understanding these boundaries helps hiring teams interpret reports fairly and decide when additional review is needed.
Second-device assistance
Software on the interview computer cannot directly observe a phone or another physical computer. Timing and behavior may create review signals, but they are not direct proof.
Encrypted DNS and cached domains
DNS-over-HTTPS can bypass the Windows resolver cache, and domains already cached before the agent starts may not appear as new network evidence. Process and title signals can still apply.
Operating-system boundaries
Signal availability and permissions differ by platform. On Windows, elevated applications can restrict lower-privilege keyboard and focus hooks. On macOS, system permissions affect available observations.
Legitimate tools
A tool can be open for an allowed reason. A reviewer must interpret it against the interview policy and timing.
Behavioral inference
Typing cadence and answer latency are weak signals on their own and can be affected by disability, language, anxiety, or interview format. They require cautious, contextual review.
Interview context
Allowed resources, accessibility needs, interview format, and company policy affect how a signal should be interpreted. The report keeps the decision with the reviewer.
Quality checks
Detection behavior is checked with positive and negative scenarios, event sequencing, heartbeat interruptions, score calculation, and report generation.
Evaluate it in your environment
Interview formats and allowed tools differ between employers. A useful evaluation should include your platforms, policies, accessibility requirements, and common candidate workflows.
Direct answers for evaluators and candidates.
How does InterviewWatch detect AI use during an interview?
Does it read keystrokes or clipboard contents?
Can one signal automatically fail a candidate?
Why is human review required?
Evaluate the method against your interview policy.
Bring your allowed tools, interview format, platform requirements, and false-positive concerns to a product review.
Request a methodology reviewAbout InterviewWatch