--- title: "How Students Bypass Browser-Based Proctoring: An AI Cheating Case Study" url: https://proctorly.ai/blog/ai-cheating-in-online-exam-proctoring-case-study/ date: 2026-08-21 modified: 2026-08-21 author: "Vivek Kishore Verma" description: "AI cheating in online exams is evolving. Explore a case study on how students bypass browser-based proctoring and why stronger exam security matters." categories: - "AI Proctoring Software" - "Case Study" - "Online Assessment Security" - "Online Exam Proctoring Software" - "Remote Proctoring Solutions" - "Secure Online Assessments" tags: - "Browser" - "Proctoring" image: https://proctorly.ai/wp-content/uploads/2026/08/AI-Cheating-in-Online-Exam-Proctoring-Case-Study-1024x512.webp word_count: 1570 --- # How Students Bypass Browser-Based Proctoring: An AI Cheating Case Study Explore a real-world AI cheating case study showing how students bypass browser monitoring using tools that operate outside the browser. - Background: A Hiring Team That Thought Lockdown Was Enough- Why Browser-Only Lockdown Fell Short- The Solution: Adding an OS-Level Layer- Implementation Approach- Results: What a Layered Approach Typically Surfaces- Lessons and Takeaways Here’s something most exam and hiring teams don’t find out until it’s too late: the sophisticated cheating rarely happens where the proctoring software is looking. It happens one layer down, at the operating-system level, while the browser window on screen looks locked and compliant. This case study follows a composite scenario built from patterns we’ve seen across multiple deployments: a multinational employer running skills-based hiring assessments for technical and analyst roles. The organization had invested in solid browser lockdown exam software and standard webcam proctoring, and on paper the setup looked airtight. In practice, the assessment team started noticing a pattern browser-side tools couldn’t explain. This piece walks through what that gap looked like, why browser-only lockdown missed it structurally, and what a layered approach — lockdown plus webcam plus OS-level monitoring typically changes about what an integrity team can see. ## Background: A Hiring Team That Thought Lockdown Was Enough The hiring team’s assessment stack was fairly typical. Candidates completed timed technical exercises and situational-judgment tests through a browser-based platform. A lockdown browser prevented tab-switching, blocked copy-paste, and disabled right-click menus, while a webcam captured video for later review. On the dashboard, session after session came back green: full-screen maintained, no tab switches logged, face detected throughout. Yet hiring managers kept flagging a strange disconnect. Candidates who breezed through the assessment with near-perfect scores were, in a meaningful share of cases, unable to explain their own reasoning in the follow-up interview — not vague or nervous, but genuinely unfamiliar with the approach their “own” submitted answer had used. That mismatch between assessment score and interview performance became the trigger for a deeper look. ## Why Browser-Only Lockdown Fell Short The core issue wasn’t a bug or a misconfiguration. It was structural. A [browser monitoring](https://proctorly.ai/blog/browser-monitoring/) tool, by design, can only see and control what happens inside its own tab. It can stop a candidate from opening a new tab in that same browser. It cannot see what’s running in the operating system underneath it. That distinction matters once you look at how modern exam and interview cheating actually plays out. Some of the most persistent workarounds never touch the monitored browser tab at all: - **Secondary off-camera devices** a second phone or tablet, out of frame, used to look up material or message a helper. - **Bluetooth earpieces** nearly invisible on camera, used for real-time whispered guidance. - **Remote-access software** tools like AnyDesk or TeamViewer letting a third party view or control the candidate’s screen from elsewhere. - **Virtual camera feeds** webcam-emulator software that pipes in pre-recorded video, so the proctoring system “sees” a compliant candidate who isn’t there. - **AI chat tools running in the background** a generative AI window, sometimes overlaid on the exam, generating answers while the browser still reports full-screen and in-focus. None of that requires defeating the lockdown browser — it just requires operating one level below it. Our [post on why webcam proctoring is no longer enough](https://proctorly.ai/blog/webcam-proctoring-why-its-no-longer-enough/) goes deeper into this gap. The [overlay windows](https://proctorly.ai/blog/overlay-windows/) problem — a window sitting visually on top of the exam without ever registering as a focus change — is one of the more counterintuitive blind spots for teams who assume “no tab switch” means “nothing else was on screen.” In short: browser lockdown answers “did the candidate leave this tab?” It cannot answer “what else is running on this machine right now?” Only one of those questions was being monitored. ![The Solution: Adding an OS-Level Layer](https://proctorly.ai/wp-content/uploads/2026/08/AI-Cheating-in-Online-Exam-Proctoring-Case-Study-2-1024x512.webp) ## The Solution: Adding an OS-Level Layer Once the pattern was diagnosed, the fix wasn’t to replace the existing stack — it was to add a layer underneath it. The hiring team implemented Proctorly’s [System Integrity Agent](https://proctorly.ai/system-integrity-agent/) alongside its existing browser lockdown and webcam proctoring, rather than swapping anything out. The System Integrity Agent runs at the operating-system level during the assessment window, giving the integrity team visibility into things a browser process cannot see: unauthorized remote-access sessions, virtual camera software, unexpected background applications (including AI chat clients), and screen-mirroring activity. Combined with the existing webcam feed and browser lockdown telemetry, that’s three layers instead of one. This lines up with a governance principle running through TatvaOne’s broader platform, including [ExaminationOS](https://proctorly.ai/assessment-integrity-platform/): AI recommends, humans decide. The System Integrity Agent doesn’t auto-disqualify anyone. It flags anomalies and packages the evidence — timestamped and exportable — into an exception report, and a human reviewer makes the final call. ## Implementation Approach Rolling out the added layer didn’t require rebuilding the assessment platform. The team worked through it in a few stages: - **Pilot on a subset of roles.** The System Integrity Agent was enabled first for higher-stakes technical assessments, so the team could calibrate a normal candidate environment against a flagged one. - **Candidate-facing transparency.** Instructions were updated to disclose plainly that system-level monitoring would run alongside webcam and browser checks. - **Exception routing.** Flags from the System Integrity Agent fed into the same review queue as webcam and browser anomalies, so reviewers weren’t juggling three dashboards — the same consolidated-decision-profile approach used in TatvaOne’s skills-based hiring workflows. - **Reviewer training.** The talent-acquisition team learned what an OS-level flag actually means: a detected remote-access tool is worth investigating, not an automatic rejection, since legitimate IT software can occasionally trigger a similar signature. - **Full rollout.** Browser lockdown, webcam proctoring, and OS-level monitoring became the standard default for all technical assessments. ## Results: What a Layered Approach Typically Surfaces Organizations that add OS-level monitoring on top of browser lockdown and webcam proctoring commonly report a similar shift, and this scenario was no exception. In the months following rollout, the integrity team began catching activity that had been invisible before: a remote-access tool running quietly in the background, a virtual camera driver present even though the webcam feed looked normal, and a smaller number of cases involving AI chat applications open behind the exam window. Just as important, the layered setup reduced false confidence. Before, a “clean” dashboard meant no tab switches and a face on camera — which told the team less than they assumed. After, a clean session meant no anomalies across three layers, a meaningfully stronger signal. Teams in comparable deployments describe this as the difference between assuming an assessment was secure and actually knowing it was. The original mismatch between assessment scores and interview performance also became something the team could investigate with evidence rather than anecdote, since exception reports could now be pulled up during offer-decision conversations. ## Lessons and Takeaways A few things generalize well beyond this one scenario: **Browser lockdown and OS-level monitoring solve different problems.** One controls the tab. The other sees the machine. Treating either as sufficient leaves the same gap, whether you’re running entrance exams, semester exams, or hiring assessments. **A “clean” browser-only dashboard is not proof of a clean session.** It’s proof that nothing happened inside the browser — a narrower claim than most teams realize until they see the difference directly. **Layering beats replacing.** None of the existing investment in browser lockdown or webcam proctoring had to be thrown out; the System Integrity Agent sits alongside it, which also kept rollout cost low. **Humans still decide.** Every flag went to a human reviewer with evidence attached. The value of secure online exam software isn’t that it renders a verdict — it’s that it gives the people who do render one something solid to look at. See our related posts on [AI-assisted cheating](https://proctorly.ai/blog/ai-assisted-cheating/) and [common exam cheating methods](https://proctorly.ai/blog/exam-cheating/) for more. If your current setup is browser-lockdown-only, ask a blunt question: how would you know if a candidate had a second device off camera, a remote session running quietly, or an AI tool open behind the window right now? For most browser-only stacks, the honest answer is that you wouldn’t. ### Frequently Asked Questions ### What does “OS-level exam proctoring” actually monitor that browser lockdown doesn’t? OS-level monitoring, like Proctorly’s System Integrity Agent, watches for activity outside the browser tab — background applications, virtual camera drivers, remote-access software, and unauthorized secondary displays. Browser lockdown exam software only controls what happens inside its own window. ### Is browser lockdown exam software still worth using if OS-level monitoring exists? Yes. Browser lockdown still stops tab-switching, blocks copy-paste, and prevents in-browser shortcuts to search or notes. It’s one necessary layer, not a replacement for OS-level visibility. Most secure online exam software setups now combine both. ### How does AI-assisted cheating typically evade browser-based proctoring? AI chat tools usually run as separate applications, sometimes overlaid on top of the exam window. Because the browser tab never loses focus, browser-only lockdown reports a normal, compliant session even while an AI tool generates answers in the background. ### Does adding system-level monitoring mean candidates are auto-disqualified for flags? No. Consistent with TatvaOne’s governance model, AI-driven monitoring flags anomalies and compiles evidence; it does not make disqualification decisions. A human reviewer evaluates each flagged case before any consequence is applied. ### Ready to See What Your Assessments Might Be Missing? If your integrity stack stops at the browser, you likely have a visibility gap you can’t currently measure. Start with [why webcam proctoring is no longer enough on its own](https://proctorly.ai/blog/webcam-proctoring-why-its-no-longer-enough/), then see how the [System Integrity Agent](https://proctorly.ai/system-integrity-agent/) adds OS-level visibility without replacing what you already use. For how this fits into TatvaOne’s broader examination and hiring integrity solutions, visit the [solutions overview](https://tatvaone.ai/tatvaone-ai-solutions.html).