The Proctor's Blind Spot: HackerRank's Recorder Can't See Control

You can pass a HackerRank proctored exam with an AI assistant if the assistant exists below the layer the proctor watches. This is not a positioning statement; it follows directly from how the capture pipeline works. A proctoring client does not see your screen the way you do. It calls the operating system for a composited image of the desktop, and it treats whatever the OS returns as the complete truth. Desktop-native software can register a window with the OS and declare that window out of scope for capture. Browser-based software owns no window at all, so it can only hide its UI inside the frame the OS produces — where the proctor's own analysis is looking for it.

This article is a technical write-up of that difference. It maps HackerRank's browser-based detection channels (Proctor Mode, as documented in 2026), explains why the dominant extension architecture fails on at least one of them structurally, and then works through the exact OS mechanisms — WDA_EXCLUDEFROMCAPTURE on Windows, NSWindowSharingNone on macOS — that let a desktop overlay be absent from every captured frame before the recorder receives a single pixel. It then scores every competitor category — extensions, other desktop overlays, phones — against those channels, and examines why the architecture that wins is a moat rather than a feature: a stack of preconditions that browser-side products structurally cannot satisfy. A verification protocol you can run on your own machine, and an honest inventory of the signals that window exclusion does not cover, close the article.

Scope, method, and evidence grades

Three different kinds of claims appear in this article, and they are marked differently throughout:

• Documented. Stated in HackerRank's support documentation or the operating system vendor's API reference. Cited inline.
• Observed. Reproducible behavior of Control as shipped (desktop app, island-window overlay, companion dashboard). Described as product behavior.
• Inferred. Reasoning from the documented mechanisms about what a given capture path will or won't include. Stated as inference, with the conditions that would falsify it.

The HackerRank documentation moves; the passages that matter here are the Proctor Mode guide (updated July 22, 2026), the Test Integrity overview (updated November 5, 2025), and the AI Plagiarism Detection documentation (updated July 22, 2026). Operating system behavior is per the Microsoft SetWindowDisplayAffinity reference and the Apple NSWindowSharingType reference. If your employer selected Desktop App Mode rather than browser-based Proctor Mode, the boundary is stricter and the analysis changes — see the companion write-up, the technical analysis of HackerRank Desktop App Mode.

How HackerRank's browser-based proctoring works

HackerRank lets the employer choose the integrity level. As of the 2026 documentation, three modes exist:

This article covers Secure and Proctor Mode — the browser-based half of the system. The two layers worth understanding technically are the page-side monitors and the screen-capture path, because they fail differently and defend differently.

Layer 1: the page-side monitors (what the exam's own JavaScript sees)

Everything that runs inside the exam page sees a well-known surface:

• Focus and visibility. blur, focus, visibilitychange, and resize events fire when the exam window stops being the active, visible window. Leaving full-screen fires a dedicated event that HackerRank documents as an input to its flagging.
• Clipboard. HackerRank's proctoring documentation states that copy-paste is monitored, and its plagiarism model consumes copy-paste activity as a signal.
• The DOM itself. The page can enumerate its own document. Anything injected into it — elements, shadow roots, style artifacts — is visible to its own code.

The key structural fact: this layer can only see what the browser tells it. It cannot see a native window that the browser never knew about, and it cannot inspect another application's process. A page-side monitor is a strong guard for the browser's territory and a blind sentry for everything outside it.

Layer 2: the capture path (what the recording or screenshots contain)

In Proctor Mode, candidates "may need to grant webcam and entire-screen sharing permissions," and HackerRank "captures screenshots throughout the session" — at a standard 15-second interval, shortening to five seconds after activity such as window switching or leaving full-screen, per the Proctor Mode guide. HackerRank additionally documents that screenshot analysis looks specifically for "external AI coding assistants, specialized browser extensions, invisible overlay applications, collaboration tools, remote-desktop software, and question-leaking tools."

That last list is the most important sentence in HackerRank's proctoring documentation for anyone using an assistant. It tells you exactly what the review pass is hunting for: visible UI that explains an otherwise-unexplained answer. And it tells you the input to that pass: frames produced by a screen-capture path. What those frames contain is determined by the operating system, not by the exam — which is where the whole game lives.

Layer 3: the behavioral and code models

HackerRank's AI Plagiarism Detection documentation says its model can consider code-writing patterns, completion time, copy-paste activity, and tab switching, and can flag unusual code replacement and cursor movement for review. Note what this model consumes: events and diffs, not pixels. A hidden overlay produces no events at all if it never touches focus, the clipboard, or the page — which is why the capture and focus layers, not the code model, are where tools get caught. The code model is the final arbiter of plausibility, discussed in the residual-risk section.

Why browser extensions get caught — three structural failure modes

Most AI interview assistants ship as Chrome extensions. This is a reasonable architecture for general use and a structurally disadvantageous one under browser-based proctoring, for three reasons that no amount of UI polish removes.

1. Focus

Extension popups open as separate browser-UI layers; side panels and full-page assistants occupy the browser's own windowing. Interacting with any of them can move focus or visibility state away from the exam frame, firing exactly the events Layer 1 is instrumented to catch. The extension and the exam share one window manager, one focus stack, and one event loop. They cannot disagree about which thing has focus.

2. Injection

To render on the exam page, an extension must inject nodes into the page's document (or shadow DOM). Those nodes belong to the document, and the document belongs to the exam's JavaScript. Enumerating document.querySelectorAll('*') and diffing against a known element inventory is a few lines of code, and popular assistants leave behind distinctive class names and structure that are easy to match. This is why "DOM guard" is a category in its own right: an extension that appears on the page has, by definition, registered itself with the page's monitors.

3. Capture

An extension's UI composites into the same surface the OS screen capture reads. There is no mechanism for a renderer-side element to ask the window server to omit it. So on Layer 2, the extension is fully present: its panel, its styling, its exact branding. And that is what HackerRank's screenshot analysis, per the documentation quoted above, is explicitly tuned to find.

A phone-based setup sidesteps all three channels — the assistant lives on a different device entirely. It is a legitimate strategy and the one most candidates default to. Its costs are all behavioral rather than technical: split gaze, an off-screen hand, and a webcam feed that a reviewer can later check for sustained off-frame eye direction. It converts a technical detection problem into a performance problem, which is a worse trade for anyone who is not comfortable acting.

The mechanism: hiding inside the camera, not from it

Every workaround above — popups with reduced opacity, panels parked off the recorded region, a second device, a virtual display — has the same logical shape: the overlay is present in the world but absent from some of the footage, and the hope is that no one cross-checks. A reviewer who sees a frame that could have contained the overlay but doesn't has a specific, uncomfortable conclusion available: someone redacted it.

Desktop-native software can change the input instead of hoping the output goes unexamined.

What a screen capture actually is

On Windows, every window's content is composed by the Desktop Window Manager (DWM) — there is no such thing as "the screen's pixels" sitting somewhere; there is a tree of windows with per-window properties, and every capture API (GDI BitBlt, DXGI desktop duplication, the Windows.Graphics.Capture used by modern recording tools) asks the composition system for a rendered view of it. On macOS, the window server plays the same role: captured output is whatever the window server composites for a capture client, filtered by per-window sharing properties and the client's Screen Recording permission.

The operational consequence, on both platforms: a window's inclusion in captured frames is a property the window's owner sets, and the composition system enforces. The capture client is downstream of that decision and, in the standard paths, does not get a second opinion.

The two flags

On Windows, SetWindowDisplayAffinity(hwnd, WDA_EXCLUDEFROMCAPTURE) marks a window so that "the window will be excluded from desktop capture" — the Microsoft reference documents the constant as available since Windows 8.1 and honored by the DWM for capture operations. The window remains fully interactive and visible to the user; it is simply not part of the image that capture APIs receive.

On macOS, setting sharingType to NSWindowSharingNone on an NSWindow — per the Apple reference — makes the window "not visible in screen recordings" and excluded from screen sharing, while it remains visible on the display and fully usable.

Both flags have the same property that makes them interesting for proctoring: the exclusion happens before the capture client exists in the picture. The recorder does not receive a frame and then drop pixels. It receives frames that never contained the overlay.

Why the difference matters to a reviewer

This is the "psychology of the technology" part, and it is not metaphorical. Two candidate framings for a session's footage:

• The redacted frame. The overlay region is blank in the recording but was presumably in use. The inference is concealment: someone hid evidence. This is the footprint of opacity tricks, off-screen panels, and "the app was closed when the screenshot fired."
• The clean frame. The OS delivered a desktop that contained exactly the exam and nothing else, for every frame and at every timestamp. The inference is nothing: there is no gap to explain, no occlusion to account for, no moment where the answer could have appeared.

A clean frame does not just avoid the flag; it removes the question. Automated pre-passes that search screenshots for assistant UI find nothing. A human reviewer scanning the replay sees a person and an editor. There is no anomaly to click on. That is a materially different position than "the overlay was hidden well," and it is the entire reason the mechanism matters.

Why extensions can't copy it

The flags are per-window, and a window is an OS object owned by a process. A Chrome extension runs as a script inside a renderer process that owns no top-level window: its "window" is a region of the browser's window, or a browser-chrome popup managed by the browser process — and in either case it is the browser that would have to set the affinity, not the extension, and a browser setting the exam tab's own window to excluded-from-capture would exclude the exam itself. The trick is reachable from the layer that owns windows. Browser-side software, and everything bolted onto it, is one layer below the lever.

What the proctor can and can't see, in practice

With Control's overlay running during a browser-based HackerRank Proctor Mode assessment (observed product behavior, as described in the technical architecture write-up):

Two rows need emphasis because they are where candidates over- and under-estimate. The capture row is the strong result: absence from every standard capture path, enforced by the OS rather than by timing. The webcam row is the honest one: nothing about window flags changes what the camera sees, and "eye and head movement" analysis is documented by HackerRank as available for at least some tests. The overlay makes the screen evidence clean; your behavior is still on record.

The scoreboard: every competitor category against the proctoring channels

The deep dive's answer, as a table: not "does tool X work," but where each tool class leaves residue on each channel. Competitor cells are from the dated head-to-head tests and published claims in the Cluely comparison and the Interview Coder breakdown; Control cells are observed behavior of the shipped desktop app, testable via the protocol below.

The "human factor" column is the same for every row — no software writes it. The differences between products live entirely in the three technical channels, and the only row silent on all three is the one built from windows up.

Why this is a moat

The mechanisms are public APIs; the moat is the precondition stack, and the desktop post carries the full treatment. In compressed form, a competitor must simultaneously have: a process that owns the window (the flag attaches to a window; renderer scripts and second devices own none), windows designed to be excluded on every claimed capture path (not "meeting screen sharing software" scope), a native input layer that consumes the trigger before the page can log it, and hit-test island architecture so the exam keeps focus with no app presence to enumerate. Browser-first teams fail at the first precondition; phone-first teams fail at the first and trade the technical problem for a behavioral one. The full five-layer analysis — including verification discipline as the fifth layer — is in the Desktop App Mode deep dive, because the stack is identical and the bar is simply higher there.

Verification protocol: test it on your machine, not on the exam

Do not let your first test of the capture exclusion be a paid assessment. Run this on a machine matching the exam's platform, and write down the date, OS version, and app versions — a result only means something under the conditions it was measured:

1. Focus channel. Open Control's public focus test, then trigger, read from, and dismiss the overlay using only the global hotkey. The page should report zero blur, visibility, or focus events. If the page reports events, your hotkey path or window configuration is wrong before you've even started.
2. Capture channel (Windows). Start any capture tool you trust — the Snipping Tool's video recording, or OBS using standard desktop capture. With the overlay visible to you, stop recording and review the frames. The overlay must be absent and the region behind it must show through. If you see the overlay, your capture path is a driver-level or remote-desktop path that bypasses DWM composition (see limitations), and you need a different machine or a different capture for the exam.
3. Capture channel (macOS). Do the same with QuickTime's window/display recording or the Screen Recording app, after granting the recorder its Screen Recording permission. The overlay must be absent from the recording while visible on the display.
4. Clipboard channel. With the overlay open, set a clipboard-monitoring page or utility in the exam tab's environment, and confirm that reading answers — without a deliberate copy — produces no clipboard events.
5. Behavior pass. Record yourself with the webcam for ten minutes working a practice problem with the overlay. Watch the playback as a hostile reviewer: where do your eyes go, and does it read as someone working, or someone splitting attention? This is the only step the technology cannot fix for you.

For the full walkthrough of how the window flags behave across capture paths, the stealth overlay deep dive covers the mechanism at the OS level.

Recommended setup for a browser-based proctored exam

1. Pick a global hotkey that cannot collide. It must be one-keypress-reachable and one the editor does not claim — a misfired hotkey is how an overlay appears at the wrong moment. Test the collision against the specific editor in your practice environment.
2. Place the overlay where your eye lands naturally. A slightly translucent panel (around 70% opacity) at the edge of the code, not over it, keeps your head still and your gaze plausibly on the problem. Opacity is a behavior aid for you, not a hiding mechanism — the capture exclusion is what hides it from the recorder.
3. Pre-warm the session before the timer starts. Log in, load the first question, and let the first round-trip complete during assessment setup. Mid-exam latency is the moment people make reviewer-noticeable faces, and the webcam does not have the flags the windows do.
4. Keep the delivery plausibly senior. Answer latency of "read, think, type" — not "read, type" — a steady rhythm, and one out-loud question at a natural point. The code model measures events; the webcam measures you; both are cheapest to satisfy by behaving like a fast person with a tool they understand.
5. Hygiene the machine. One physical display (multi-monitor and mirroring are documented flag triggers), browser-only distractions closed, webcam pointed at you and nothing else, and nothing on the desktop that a frame would explain poorly.

For the broader screen-share workflow — video interviews rather than coded proctoring — the tradeoffs between overlay, phone-remote, and browser-based tools are laid out in the AI interview assistant screen-share workflow guide.

Residual risk, honestly inventoried

Window exclusion is a strong claim with a precise boundary. The boundary is worth stating:

• Webcam channels are untouched. Gaze analysis, face-count checks, and a human watching the feed all still work. The overlay makes the screen clean; it does not make your face lie.
• Driver-level and remote capture paths may bypass composition. Some GPU-driver capture, remote-desktop protocols, and magnifier-style tools read pixels from a different layer than standard DWM composition. Inference: the standard paths used by assessment tooling honor the exclusion; the exotic paths are the ones your verification protocol is for. If your exam requires a specific capture client, test that client in step 2 or 3.
• The code and behavior models still run. A solution that appears in one burst at a speed the typing telemetry finds unusual is flaggable regardless of what the screen showed. The overlay controls the pixel evidence; your typing and timing are the rest of the record.
• Policy is upstream of technology. If the employer's rules prohibit external assistance, no capture behavior changes that — a flagged or unflagged session is a rule violation either way. Read the rules screen and, when in doubt, ask the recruiter in writing before the deadline. The ethics guide for AI interview assistance frames the distinction between concealment and permitted tool use.
• If the invitation says Desktop App Mode, this article's analysis does not apply. That mode replaces the browser's window manager with HackerRank's own native app — stricter blocking, full recording, and its own set of capture paths. That is what the Desktop App Mode capture analysis is for.

HackerRank proctoring questions, answered one at a time

• Is HackerRank proctored?
• Does HackerRank record your screen?
• Does HackerRank use your camera?
• Does HackerRank record audio?
• Does HackerRank detect cheating?
• Can HackerRank see your other tabs?
• Does HackerRank detect multiple monitors?
• Can HackerRank detect ChatGPT, Copilot, or Cluely?
• Does HackerRank detect copy and paste?
• Does HackerRank track keystrokes?
• What to expect in a HackerRank proctored test
• HackerRank desktop app requirements

The short version

HackerRank's browser-based proctoring runs on three channels: the page's own event and DOM monitors, the operating system's capture pipeline, and models over code and behavior. Extensions fail the first two structurally — they live inside the document the page inspects and the frame the OS produces — and phone setups trade those for a behavioral tax. Desktop-native software can do something no browser-side tool can: mark its windows out of scope for capture at the composition layer, so every frame the proctor receives is a true image of a desktop that, by the OS's definition, contained no overlay. The recorder doesn't miss the overlay; it never had it. Your job is the part the OS can't do — a webcam feed and a typing record that read as a person who knows the material and happens to have good tools.

The fastest way to verify the mechanism on your own machine is the stealth overlay deep dive; if your assessment is the desktop app, start with the Desktop App Mode analysis instead.