See past the ghost in the room. AI interview cheating detection for live technical interviews

Effect.In a live coding interview the candidate answers every question fluently. The shared screen shows nothing but their editor. Nothing looks wrong.

Method.An AI assistant sits in a window the screen share can't see, summoned by a hotkey the interview never receives. UnGhosted reads the tells the trick leaves behind and shows them to the interviewer as plain signals, never a verdict.

Request early access

Both apps ship together, free while UnGhosted is in early access.

Or go straight to the downloads
SOLUTION.PY
Fig. 1. As the interviewer sees it: a clean editor. Press “Reveal the method” to draw in what's hidden.
  1. 1The assistant's window sets one Windows flag, WDA_EXCLUDEFROMCAPTURE, and drops out of every screen share. UnGhosted reads the flag itself.
  2. 2Ctrl+Enter goes to the assistant, not the interview. UnGhosted notices the half of the keystroke that still gets through.
  3. 3The answer arrives as a paste. UnGhosted logs it with its length and the moment it happened.

Four more tricks, and the tell each one leaves.

AI didn't just learn to write. It learned to sit in the room. Each trick below hides from the interviewer's eyes, and each one still leaves a trace on the candidate's machine. UnGhosted reads the trace and writes it down in plain language.

Lesson II. The vanishing window

Effect.The interviewer watches the shared screen. It shows the editor and nothing else.

Method.The assistant's window sets one Windows display-affinity flag, WDA_EXCLUDEFROMCAPTURE, and is left out of every screen share and recording.

The tell.The desktop app checks every window for that flag and names the one that's hiding. The browser version can't see it, so use the desktop app when you can.

hidden
Fig. 2. The assistant’s window, stacked over the editor and left out of the share.

Lesson III. The silent hotkey

Effect.The candidate pauses for a moment, then answers perfectly.

Method.A global hotkey, often Ctrl+Enter, summons the answer. The operating system hands the key to the tool, so the interview window never receives it.

The tell.The half of the keystroke that leaks through: a Ctrl with no partner, an Enter released that was never pressed. Any combo pressed over and over with no visible effect is flagged too.

Ctrl+Enternever received
Fig. 3. Ctrl reaches the interview; the Enter that follows never does.

Lesson IV. The borrowed answer

Effect.A complete function appears in the editor in one go.

Method.The answer is pasted from another window, or typed in by a script faster than hands can move.

The tell.Every paste is logged with its length and time. A burst of keystrokes under 30 milliseconds apart reads as injected input.

412
Fig. 4. Four lines that arrived at once, logged as a 412-character paste.

Lesson V. The glance away

Effect.Steady, confident answers, with the eyes held just off the screen.

Method.The candidate reads from a phone, a second monitor, or someone off camera.

The tell.On-device gaze and head-pose tracking, line-by-line reading patterns, and the sound of typing when no key is pressed in the interview.

off-screen
Fig. 5. A line of sight that leaves the screen for a phone below it.

The performance, annotated.

This is what the interviewer reads during the call: what happened, and when. No score decides for them. The log below is an illustrative session, not a real candidate.

Sample session · 45 min
  1. 00:00Session started. Both sides consented to recording.Note
  2. 04:12Candidate switched away from the interview tab for 6 seconds.Caution
  3. 11:38Clipboard paste, 18 characters.Note
  4. 17:05Gaze off the screen for 9 seconds.Caution
  5. 23:41A window named “Assistant” is hidden from screen capture.Warning
  6. 23:44Hotkey Ctrl+Enter was taken outside the interview window.Caution
  7. 23:52Clipboard paste, 412 characters.Caution
  8. 31:20Typing heard with no keys pressed in the interview.Caution
  9. 44:58Session ended by the interviewer.Note

Three tells in eleven seconds at 23:41 deserve a question, not a conclusion. The log says what happened; the interviewer decides what it means.

The apparatus: one app for each side of the call.

The candidate app

The room your candidate sits in

A locked-down kiosk window: full screen, no window switching, no exit shortcuts except the one your proctor controls. The candidate joins, and the interview is the only thing on screen.

  • Kiosk-locked for the whole session
  • Camera and voice presence checks
  • Nothing is decided on their end

The browser version needs a full-screen share in Chrome, Edge or Firefox and can't see windows hidden from capture.

The interviewer app

Your live control room

The risk score, a timestamped event log, the processes running on the candidate's machine, and the video call itself, side by side, so you stay in the conversation instead of hunting for a second screen.

  • A running risk score with the log behind it
  • Full event timeline per session
  • Company rooms, join codes and history

Runs as a Windows app or straight in the browser.

Questions from the audience.

Is UnGhosted an anti-cheat tool for interviews?

Yes — UnGhosted is purpose-built anti-cheat software for live technical interviews. Instead of relying on the interviewer noticing something by eye, it directly checks for the mechanisms AI-assisted cheating tools actually use, like a display-affinity flag that hides a window from every screen share.

What does UnGhosted actually detect?

Three things: behavioral signal (tab switches, window blur, clipboard pastes, keystroke cadence, hotkeys swallowed by hidden tools), hidden-window detection (some tools set a Windows display-affinity flag to disappear from any screen share — UnGhosted checks for that flag directly), and camera-based presence tracking (gaze, head pose, and blink-based attention).

Does UnGhosted work with Zoom, Google Meet, or Microsoft Teams?

No — UnGhosted isn't a plugin for an existing video tool. The candidate and interviewer apps include their own built-in video call, so the interview itself runs inside UnGhosted rather than alongside it.

Does it give a pass/fail verdict on a candidate?

No. UnGhosted surfaces the underlying signal — a tab switch, a hidden window, a gaze deviation — in plain language, and the interviewer decides what it means. Signals, not verdicts.

What platforms are supported?

The Windows desktop apps are available now, with macOS and Linux coming soon. Both apps also run in the browser (Chrome, Edge or Firefox) with no install.

How much does it cost?

Both apps ship together and are free to use while UnGhosted is in early access.

How do I get access?

Request access above, or go straight to the download page if you're ready to install both apps now.

Don't let the room get ghosted.

Request access to try UnGhosted on your next technical interview. Both apps ship together, free while we're in early access.

Request access

Leave your work email and we'll write back.

Or download the apps directly