How to Detect AI Cheating in a Software Engineer Live Coding Screen

A live coding screen is compromised by AI when a candidate types a fluent, edge-case-complete solution after a long unexplained pause, glances repeatedly at a fixed off-screen point, or narrates a solution that doesn't quite match the code they're actually typing — all signs of a second device, an overlay tool, or a hidden LLM feeding the answer in real time. Because live coding screens run over Zoom or Teams with a shared editor (CoderPad, VS Code Live Share, or similar), the interview session itself is the surface to instrument: gaze, audio cadence, device count, and window focus all leave a trail before the code ever reaches the editor.

Threat Model, Tells, and Evidence to Capture

Threat Model	Observable Tell	Evidence to Capture
Second monitor or phone running an AI chat while screen-sharing only the editor	Fixed, repeated gaze toward a point outside the shared window; reading-pattern eye movement rather than "thinking" gaze	Gaze-direction timeline synced to code timestamps; screen-share completeness check (full desktop vs. single app window)
Earpiece or a remote engineer relaying the solution live in a side chat	Delayed response to the interviewer's question followed by an unnaturally fluent, fully-formed answer with no self-correction	Audio dead-air-to-speech transition scoring; ambient Bluetooth/device pairing detection
Invisible overlay or "interview assistant" browser extension injecting text	Code appears as a paste or multi-character burst instead of incremental keystrokes; no typos or backspaces typical of live typing	Keystroke cadence and paste-event log; browser extension inventory scan during the session
Proxy interviewee joining under the candidate's name	Face doesn't confidently match the resume or LinkedIn photo; voice or typing style shifts mid-session	Face-match verification against ID; session-continuity check for webcam presence gaps

Interviewer Script

Use this once the candidate has written five to ten lines:

"Before you keep going — walk me through why you chose that data structure over a hash map." This forces live justification; AI-fed answers tend to stall here.
"Stop for a second. Can you introduce a bug on purpose in that loop, then find it?" Genuine coders adapt instantly; a relayed answer can't improvise off-script.
"I'm changing one constraint: the input is now unsorted. What changes?" This tests real-time reasoning against a pre-fetched solution.
If a long pause precedes a suspiciously polished answer, ask a throwaway clarifying question first ("What language are we in again?") and watch whether the fluent response returns immediately, or whether there's a second delay while a device is consulted.

The single strongest combined tell reported across engineering hiring teams this year is silence, followed by a complete, well-organized monologue with no verbal stumbling.

FAQs

Is it fair to flag long pauses — don't engineers think before they type? Thinking pauses are normal, but they're usually followed by incremental, exploratory typing with corrections. The AI-cheating tell is a pause followed by a large, clean, correct block appearing almost instantly.

Can a virtual camera bypass this kind of monitoring? Virtual camera drivers such as OBS or ManyCam leave a detectable software signature. Neuroxa AI Meeting Proctor flags them automatically rather than trusting the raw video feed.

What if the candidate is just a fast typist? Fast, correct typing after visible incremental drafting is normal. The distinguishing signal is the paste-or-burst pattern combined with the absence of any false starts — genuine problem-solving includes dead ends.

Does detection tooling replace asking good interview questions? No. Detection signal and a sharper interviewer script work together — the script above is designed to surface tells a recording alone might miss.

How big is this problem really? Gartner projects that by 2028, 1 in 4 candidate profiles worldwide will be fake or AI-assisted. Fabric's dataset of 19,368 interviews (July 2025–January 2026) found 48% of software engineering interviews flagged for AI-cheating signals — live coding screens are the single highest-risk format in that funnel.

What should happen after a session gets flagged? Route it to a human reviewer for a short live follow-up before any offer decision — flags are a prioritization signal, not an automatic rejection.

Related Guides

Get the Evidence Before You Extend an Offer

Live coding screens are the exact format Karat found where 80% of candidates use LLMs during banned code tests — a raw video call gives you none of the gaze, cadence, or device-fingerprint signal you need to catch it. Neuroxa AI Meeting Proctor runs alongside your Zoom or Teams call, flags off-screen gaze, virtual-camera use, and audio dead-air patterns in real time, and hands your interviewer a scored report before the debrief.