Can ChatGPT Be Detected During Online Exams?

Why text-based AI detectors are the wrong tool

Post-hoc detectors judge finished prose that no longer carries dependable authorship signals. They produce both false accusations and easy evasions, and light rephrasing is usually enough to defeat them. Building an academic-integrity case on a probability score leaves an institution exposed at appeal.

Session evidence is a different category of proof. Rather than arguing about whether text looks generated, the institution can point to what was running on the machine during the assessment and exactly when.

Why browser-based tools cannot see the assistance

Browser extensions and lockdown browsers observe the page, the tab, and often the webcam. Their visibility ends where the browser process ends, and that is precisely where modern AI assistance lives.

Desktop assistants and answer overlays render above every other window, are frequently excluded from screen capture and screen sharing, and never interact with the assessment tab. Remote-control tools, virtual machines, injected keyboard input, and a second device off camera are equally invisible from inside the browser.

• Native overlay applications draw over the assessment and are often excluded from screen share.
• Remote-access tools allow another person to drive the machine with no browser-visible trace.
• Virtual machines let the assessment run inside a controlled environment with helpers outside it.
• Injected or synthesized keyboard input can enter answers that were never physically typed.
• A second phone, tablet, or monitor off camera leaves nothing at all in the browser.

What device-level detection observes

Reliable detection has to happen at the layer where assistance runs: the operating system. ScreenComply pairs a browser-based API with an optional desktop agent that inspects the environment around the assessment rather than only the page inside it.

The agent enumerates running processes and browser extensions against a maintained list of AI assistants and answer overlays, looks for always-on-top or transparent windows, detects remote access and virtualization, enumerates connected displays from the operating system, verifies that keyboard input originates from local physical hardware, and records focus changes, clipboard events, and typing-cadence patterns.

No detection system catches everything, and ScreenComply does not claim otherwise. The objective is corroborating, timestamped evidence that lets a human reviewer make an informed and defensible decision.

• Process and extension enumeration against a maintained AI-assistant list.
• Overlay, transparency, and always-on-top window detection.
• Remote access, virtual machine, and screen-capture driver detection.
• Display enumeration reported by the operating system, not inferred from gaze alone.
• Input-source integrity, clipboard events, and typing-cadence analysis.

What a detection looks like in practice

In a typical flagged session, several independent signals line up in the same seconds: a restricted assistant process appears, an always-on-top window is drawn over the exam, focus leaves the assessment, and answer entry arrives as a burst rather than as composition. Any one of these alone is weak. Together and correlated in time, they form a picture a reviewer can act on.

Institutions choose how far to go. Detect mode observes quietly and flags anomalies for review; Prevent mode blocks restricted applications from launching inside the assessment window.

Turning signals into a report someone can defend

A detection is only useful if it can be explained to a person who was not in the room. Every session produces a structured integrity report: an executive verdict with a graded risk level, a chronological evidence timeline, and the underlying signal detail behind each entry.

Language is deliberately factual rather than accusatory, because the institution or employer makes the decision, not the software. Reports export to PDF and can be shared through a secure link for academic-integrity hearings, HR reviews, and compliance audits, with configurable retention including zero-retention operating modes.