Stealth Technology Deep Dive: Why Recording Detection Fails Against Interview AiBox

The interviewer starts screen recording. They share their screen. They watch your every move. But they cannot see your AI assistant.

This is not magic. It is careful architecture built on macOS native APIs, strategic window configuration, and a deep understanding of how screen capture works. This article explains the technical foundations of Interview AiBox's stealth capabilities.

3 Common Recording Detection Methods

Before understanding how to bypass detection, understand what detection looks like.

Screen Capture API Monitoring

Most obvious detection method: the interviewer uses screen recording software like Zoom, Teams, or OBS. These tools capture the entire screen or specific windows using operating system APIs.

How it works:

• Application calls screen capture APIs (CGWindowListCopyWindowInfo on macOS)
• OS returns list of visible windows and their content
• Recording software encodes and transmits the captured frames

What gets captured:

• All visible windows
• Window titles and positions
• Content inside windows (unless protected)

Process List Scanning

More sophisticated detection: the interviewer runs a process monitoring tool that lists all running applications.

How it works:

• Application calls process enumeration APIs (ps, Activity Monitor APIs)
• OS returns list of running processes with names and PIDs
• Monitoring tool displays process names and resource usage

What gets detected:

• Process names like "Interview AiBox" or "interview-aibox"
• Helper processes or background services
• Unusual resource usage patterns

Window Title Detection

Subtle but effective: screen recording software often captures window titles even if content is protected.

How it works:

• Screen capture APIs include window metadata
• Window titles appear in taskbar, dock, or window switcher
• Even protected windows may have visible titles

What gets detected:

• Window titles containing "AI" or "Interview"
• Unusual window names in window switcher
• Windows that appear in dock but not in recording

Interview AiBox Stealth Architecture

Four techniques work together to bypass all detection methods.

Recording Immunity

The foundation: Interview AiBox sets the contentProtection flag on its window.

What this does:

• Tells macOS that this window should not be captured by screen recording APIs
• Excludes the window from CGWindowListCopyWindowInfo results
• Prevents the window from appearing in screenshots, screen recordings, and remote desktop sessions

How it works:

// Electron BrowserWindow configuration
new BrowserWindow({
  contentProtection: true,
  // ... other options
})

This single flag makes the window invisible to Zoom, Teams, OBS, QuickTime screen recording, and even macOS Screenshot utility.

Process-Level Hiding

Beyond window protection: Interview AiBox hides its process from standard enumeration.

Techniques used:

• Process name obfuscation
• Agent attribute setting on macOS
• Background process classification

Result: The process does not appear in Activity Monitor under obvious names, and does not show up in standard process list tools.

Click-Through Mechanism

Invisibility is not enough. The window must also not intercept input events.

What this does:

• Allows mouse and keyboard events to pass through to underlying windows
• Prevents the AI assistant window from stealing focus
• Makes the window behave like an overlay rather than a normal window

How it works:

// Electron BrowserWindow configuration
new BrowserWindow({
  setIgnoreMouseEvents: true,
  focusable: false,
  // ... other options
})

This means you can click "through" the AI assistant window to interact with other applications, and the AI assistant never steals focus from your video call or coding environment.

Dock Invisible

Final touch: the window should not appear in the dock or window switcher.

What this does:

• Removes the application from the dock
• Excludes the window from Cmd+Tab switcher
• Makes the window truly invisible at the OS level

How it works:

// Electron app configuration
app.dock.hide()

The application is running, but it has no dock icon, no menu bar presence, and no window switcher entry.

Clever Use of macOS Native APIs

The real power comes from strategic use of macOS-specific APIs.

CGEventTap at SESSION Level

For keyboard shortcuts that must work even when other applications are focused, Interview AiBox uses CGEventTap at the SESSION level.

What this does:

• Intercepts keyboard events at the system level
• Works regardless of which application has focus
• Allows global hotkeys without appearing in the dock

Why SESSION level matters:

• SESSION level taps work even when the application is backgrounded
• Lower level taps require Accessibility permissions but provide more control
• Interview AiBox uses this to enable global hotkeys like Cmd+Shift+A to toggle visibility

Permission requirement: This requires Accessibility permission in macOS System Preferences. Interview AiBox prompts for this permission on first launch.

Content Protection Flag

The contentProtection flag is the core of recording immunity.

Technical details:

• Sets the NSWindowSharingNone sharing mode on the underlying NSWindow
• Tells the window server to exclude this window from all capture operations
• Works at the window server level, so it affects all capture methods

Limitations:

• Does not protect against physical cameras pointed at the screen
• Does not protect against users who manually photograph the screen
• Requires macOS 10.13 or later for full functionality

Window Level Configuration

Window layering determines which windows appear on top.

Interview AiBox configuration:

• Sets window level to "floating" (above normal windows but below menus)
• Uses alwaysOnTop to ensure visibility when needed
• Adjusts level dynamically based on user preferences

Why this matters:

• Floating level ensures the AI assistant appears above your coding environment
• But below system menus and dialogs
• Creates a natural overlay experience without blocking critical UI elements

Why Remote Desktop Sharing Still Cannot See It

Remote desktop protocols like RDP, VNC, and TeamViewer work at different levels.

Screen Scraping Protocols

Protocols like VNC capture the screen at the framebuffer level.

How they work:

• Capture the entire screen framebuffer
• Encode and transmit to remote client
• Remote client displays the received frames

Why contentProtection works:

• macOS window server excludes protected windows from the framebuffer
• Even low-level screen scraping cannot capture protected content
• The window simply does not exist in the captured framebuffer

API-Based Protocols

Protocols like RDP use higher-level APIs to capture windows.

How they work:

• Use the same screen capture APIs as local recording software
• Query the window server for visible windows
• Encode and transmit window content

Why contentProtection works:

• These APIs respect the contentProtection flag
• Protected windows are excluded from the window list
• The remote client never receives the protected window

The Only Exception

Physical cameras pointed at the screen can capture protected windows.

Why:

• Physical cameras capture light emitted from the screen
• This bypasses all software protections
• No software can prevent physical capture

Mitigation:

• Position the AI assistant window in a corner of the screen
• Use a small window size
• Be aware of physical cameras in the environment

FAQ

Does this work on Windows or Linux?

Currently, Interview AiBox's stealth features are optimized for macOS. Windows and Linux have different window management APIs and different capabilities for window protection. Some features may work on other platforms, but full stealth capability is currently macOS-specific.

Can this be detected by sophisticated monitoring tools?

Extremely sophisticated tools that monitor at the kernel level or use hardware-level monitoring could potentially detect Interview AiBox. However, such tools are rare in interview contexts and typically require administrative access to install. For typical interview scenarios, Interview AiBox's stealth is effective.

What if the interviewer asks me to show my entire desktop?

This is a judgment call. You could explain that you prefer not to share your entire desktop for privacy reasons and offer to share specific windows instead. Alternatively, you could temporarily disable Interview AiBox for that portion of the interview. Know your comfort level and the company policy before the interview.

Are there any performance impacts from stealth features?

Minimal. The contentProtection flag is handled by the window server and has negligible performance impact. Process hiding and dock hiding are one-time operations with no ongoing cost. The main performance consideration is the global hotkey monitoring, which uses minimal CPU.

Next Steps

• Learn about real-time assist best practices to understand how to use AI assistance effectively
• Read about natural expression techniques to make AI assistance look like your real thinking
• Explore core features to understand all Interview AiBox capabilities
• Download Interview AiBox to experience stealth technology firsthand

Author: Interview AI Team
Published: 2026-04-07