CodebustedCluely and similar AI overlay tools are being used by candidates to cheat in remote coding interviews. Here's how they work, why traditional tools can't detect them, and how Codebusted catches them.
Remote technical interviews have a new problem. It's not screen sharing or copy-pasting from Stack Overflow anymore — it's AI overlay tools like Cluely that sit invisibly on top of the screen, reading the question and typing answers character by character, fast enough to look like a human.
If you're running remote coding interviews right now, there's a good chance some of your candidates are already using it.
Cluely is an AI overlay tool that reads your screen and generates answers in real time. The candidate sees the problem, Cluely reads it, and starts suggesting code — which the candidate then types out, or which Cluely types automatically at a speed that's fast but still plausible enough to look human.
It's designed specifically to be undetectable by browser-based proctoring tools. It operates at the operating system level, above the browser, which means:
HackerRank, CoderPad, and CodeSignal all operate inside the browser. They can see what's happening on the webpage — tab switches, copy-paste events, focus changes — but they have no visibility into what's happening at the OS level.
Cluely is specifically designed to exploit this gap. It runs as a separate process with elevated memory access, reads the screen using system APIs, and injects suggestions through keyboard simulation. None of this is visible to a browser-based tool.
Codebusted takes a different approach. Our desktop app runs at the OS level alongside the interview — not inside the browser — which means it can see what browser-based tools can't.
AI overlay tools like Cluely have a distinctive memory signature. They poll the screen at regular intervals, which creates a rhythmic memory access pattern that doesn't look like any normal application. Codebusted monitors active process memory during the interview and flags any process showing these patterns — regardless of what the process is named.
This means it works even if Cluely is renamed or disguised.
Even when Cluely types slowly to appear human, it's still faster and more consistent than real human typing. Real humans make micro-errors, pause to think, and vary their speed. AI-assisted typing is rhythmic and unnaturally consistent.
Codebusted analyzes keystroke velocity every 2 seconds. If the candidate types more than 15 characters per second in a sustained burst — a threshold no human typist reaches naturally — it's flagged as a potential AI pattern. Each flag is logged with a timestamp, character count, and velocity.
A common workaround is running Cluely on a second screen while the interviewer only sees the primary screen. Codebusted detects when an external monitor is connected at session start or plugged in mid-interview, and logs it immediately to the recruiter's live timeline.
When a candidate alt-tabs to check Cluely's output on another window, or minimizes the interview app to look at a secondary tool, Codebusted catches it. Every focus change, window switch, and app minimize event is logged with a precise timestamp.
After every interview, Codebusted generates a PDF report that includes the integrity score, a full event timeline, AI typing pattern flags with velocity data, the candidate's final code snapshot, and any process memory alerts.
If a candidate used Cluely, you'll typically see a combination of: sustained high-velocity typing bursts, possible external monitor detection, and a final code submission that's more polished than the typing pattern suggests it should be.
If you're running remote coding interviews without OS-level monitoring, you're flying blind. Browser-based tools give you a false sense of security — they catch sloppy cheating but miss the sophisticated tools candidates are actually using.
Questions? Email codebustedofficial@gmail.com