How to Detect Cluely and Tools Like It

What Cluely-style tools do mechanically

These applications listen to the session, generate answers with a language model, and render them in an always-on-top or transparent window that sits above the assessment or interview. Because they are native desktop programs, they do not need to switch browser tabs or interact with the exam page; the candidate can read answers while the browser shows only the assessment.

The same pattern applies whether the tool is branded for interviews, coding assessments, or general exams. The relevant fact is that the assistance layer lives in the operating system, not in the browser.

Why browser-based tools cannot see the assistance

Browser extensions and lockdown browsers observe the page, the tab, and often the webcam. Their visibility ends where the browser process ends, and that is precisely where modern AI assistance lives.

Desktop assistants and answer overlays render above every other window, are frequently excluded from screen capture and screen sharing, and never interact with the assessment tab. Remote-control tools, virtual machines, injected keyboard input, and a second device off camera are equally invisible from inside the browser.

• Native overlay applications draw over the assessment and are often excluded from screen share.
• Remote-access tools allow another person to drive the machine with no browser-visible trace.
• Virtual machines let the assessment run inside a controlled environment with helpers outside it.
• Injected or synthesized keyboard input can enter answers that were never physically typed.
• A second phone, tablet, or monitor off camera leaves nothing at all in the browser.

Blocking versus detecting

Blocking applications is one approach; detection produces evidence. Prevent mode blocks restricted applications from launching during the session, so the assistance never starts. Detect mode allows the session to run and records what happens, producing a deterministic restricted-program finding with process hash and timestamp in an audit-ready integrity report for human review.

The right choice depends on the institution's or employer's policy. High-stakes assessments often use Prevent mode so a banned tool cannot open. Investigations and lower-stakes screens may prefer Detect mode, which preserves a record of what occurred and supports a proportionate human response.

The category of similar tools

Cluely is one example of a broader category of desktop assistants and answer overlays built for interviews and exams. Interview Coder and LockedIn AI are also named examples that operate in the same space. They differ in branding and interface, but they share the same mechanical pattern: a native application that generates or surfaces answers outside the browser.

ScreenComply maintains a list of these applications and updates it as new tools appear. Detection is not limited to one name; it targets the behavior pattern: overlay windows, restricted processes, and anomalous input during the session.

What universities should do

A university should start with a clear AI-use policy that names banned tool categories, not only brands, because names change quickly. The policy should state that device-level monitoring is in use, what is permitted, and how a flagged session is reviewed.

Enforcement should combine device-level detection with human review. A restricted-program finding is the start of a review, not a verdict. The integrity report gives the committee a timestamped record of what ran on the machine and when, which is far more defensible than a suspicion based on behavior alone.

What employers should do

Employers should apply the same layer during remote interviews and technical assessments. Disclose the check in the interview invitation, run it consistently for every candidate at a stage, and route every flagged session through the same HR review process.

Detect mode supports proportionate responses: a flag can prompt a follow-up question or a verified re-interview rather than an immediate rejection. Prevent mode can block restricted applications outright for final-round or regulated hiring. In both cases, the integrity report documents the basis for any later decision.

Turning signals into a report someone can defend

A detection is only useful if it can be explained to a person who was not in the room. Every session produces a structured integrity report: an executive verdict with a graded risk level, a chronological evidence timeline, and the underlying signal detail behind each entry.

Language is deliberately factual rather than accusatory, because the institution or employer makes the decision, not the software. Reports export to PDF and can be shared through a secure link for academic-integrity hearings, HR reviews, and compliance audits, with configurable retention including zero-retention operating modes.