A few years ago, the concern about AI in online assessments was theoretical. Today it is not. GPT-powered browser plugins can prefill answers to multiple choice exam questions the moment they appear on screen, regardless of the topic or difficulty level. The learner does not need to read the question. They do not need to understand it. The answer is already there.

Integrity Advocate has been tracking this development closely. The response is ExposeAI, a new detection capability built directly into Integrity Advocate's monitoring suite.

How GPT-Powered LMS Plugins Work

Learning Management System plugins powered by generative AI have proliferated rapidly. Among the tools currently in use are Github Copilot, AnswersAI, ConchAI, Jasper, ChatSonic, Coursology, Hyperwrite, Quillbot, and Monica, among dozens of others that continue to emerge.

These tools share several characteristics that make them particularly difficult to address through standard LMS countermeasures:

• They are inexpensive or free to obtain
• They require no technical expertise to install or activate
• Once installed, they operate automatically and continuously
• They are designed to conceal their presence and adapt to detection attempts
• New variants emerge faster than most platforms can respond

As a result, organizations relying on their LMS provider to develop effective countermeasures are unlikely to find one. LMS companies have no current solutions to this threat, and the nature of these plugins makes them unlikely to be eradicated through platform-level defenses alone.

The integrity of online assessments and certifications depends on a different approach.

Why This Matters for Assessment Integrity

The implications extend beyond academic dishonesty. For organizations issuing certifications that carry regulatory or legal weight, an assessment completed with AI assistance is not a valid measure of knowledge or competency. The certification it produces is as hollow as one issued without any training at all.

The same worker who received a fraudulent safety certification from a provider that did not deliver training could receive an equally fraudulent certification from an organization that delivered the training but could not prevent AI tools from completing the assessment on the learner's behalf. The outcome is the same: a credential that does not reflect what the person actually knows.

Introducing ExposeAI

ExposeAI is Integrity Advocate's purpose-built response to AI-assisted assessment fraud. It can be incorporated into Integrity Advocate's existing monitoring suite without any technical effort from clients, and works across the full range of devices and browsers that Integrity Advocate supports, from mobile to desktop.

ExposeAI is designed to detect the presence and use of GPT-powered plugins during an assessment session, giving organizations the visibility they need to maintain the integrity of their certification and training programs in an environment where AI tools are becoming standard equipment for learners looking to shortcut the process.

This is part of Integrity Advocate's broader commitment to staying ahead of the threats that matter most to the programs it serves. Human review remains at the core of every session. ExposeAI adds a layer of detection specifically designed for the AI-assisted cheating methods that automated systems alone cannot reliably identify.

The Broader Picture

AI cheating tools are not a passing trend. They are becoming cheaper, more capable, and more widely available. Organizations that do not have a response to this threat are issuing certifications they cannot stand behind.

Integrity Advocate's approach combines human review with purpose-built AI detection, so the results your program issues reflect what learners actually know, not what an algorithm answered for them.

{{post-cta}}

Not all proctoring tools work the same way. Before you compare features, pricing, or integrations, the most important decision is the model underneath the platform. If you get that wrong, everything else falls apart.

There are three approaches to online proctoring. Each has a legitimate use case. Each has a real trade-off. And one of them is consistently misunderstood as the safe middle ground when, in practice, not all hybrid models are equal.

As the market scales, programs are under more pressure than ever to choose the right model. Here is what each one actually means and what it means for your program.

The Three Proctoring Models

1. AI-Only Proctoring

AI-only platforms monitor sessions using algorithms. They track eye movement, audio patterns, browser behavior, and screen activity. When the system detects something outside expected parameters, it flags it. The report goes to your institution. Your team decides what to do with it.

The appeal is real. These tools are low cost, highly scalable, and require minimal vendor involvement. For programs running thousands of low-stakes assessments, that efficiency matters.

49% of students globally participated in online learning by March 2025 — driving demand for proctoring that scales without sacrificing accuracy. Source: Business Research Insights, 2026

The risk is also real. AI-only platforms typically flag 15 to 20 percent of all sessions. Many of those flags are not genuine integrity violations. Without a human reviewing the flag before it reaches your inbox, your team is doing that work. The savings on the tool often do not account for the time your staff spends sorting through incidents.

"When a result is challenged, the answer 'the algorithm flagged it' is not a defensible audit trail."

For programs where outcomes carry weight, that gap is a liability.
AI-only works when stakes are low, volume is high, and your institution has capacity to review flags internally.

2. Live Human Proctoring

Live proctoring puts a trained human proctor in the session in real time. The proctor monitors the exam as it happens, can communicate with the test taker, and can intervene if something goes wrong.

The accuracy is high. The human judgment is present. The audit trail is strong. For high-stakes licensing exams, certification bodies with regulatory requirements, and professional credentials where disputes are foreseeable, live proctoring has historically been the answer.

The trade-offs are scheduling and cost. Test takers need to book a time slot. Proctors need to be available. Per-session pricing adds up quickly at scale. For programs delivering hundreds or thousands of exams across flexible windows, the logistics become unworkable.

48% Of students expressed discomfort with webcam-based monitoring during exams — a signal that the model you choose directly affects learner trust in your program. Source: Business Research Insights survey, 2023

Live proctoring is also more intrusive for the learner. Being watched in real time creates anxiety that can affect performance. For programs that care about the experience of their test takers, that friction is worth accounting for.
Live proctoring works when stakes are high, volume is manageable, scheduling is structured, and real-time intervention is a non-negotiable requirement.‍

3. Hybrid Proctoring: The Model That Varies Most

Hybrid proctoring combines AI monitoring with human review. In principle, it offers the best of both approaches. In practice, it depends entirely on one question: when does the human review happen, and is it mandatory?

Many platforms that describe themselves as hybrid use AI for detection and offer human review as an optional tier or a paid escalation. That is not a genuine hybrid. It is AI-only with an appeal process.

Integrity Advocate is built on this model. Human review is not an upgrade.

Hybrid proctoring with mandatory human review delivers scale without shifting the review burden to your institution.

The Question to Ask Every Vendor

When a flag is raised, who reviews it, and when?

If the answer is your team reviews it, or a human reviews it if you escalate, you are looking at AI-only with extra steps. If the answer is our reviewers examine every flag before it becomes an outcome, you are looking at a genuine hybrid. That question takes 30 seconds and tells you more than a 90-minute demo will.

{{post-cta}}

The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.

The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.

The Threat Landscape Has Changed

Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.

Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.

The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.

Why Proctoring Plugins Create Specific Risk

Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.

Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.

At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.

What a Code Review Should Cover

Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:

• Potential malware embedded in the plugin or extension code
• Errors or vulnerabilities that could be exploited by third parties
• Whether the software receives automatic updates, and what review process governs those updates
• What data the software transmits, to where, and under what conditions

If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.

The Case for No-Installation Proctoring

The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.

For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.

The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.

{{post-cta}}