If ChatGPT Can See the Question, Is Your Online Exam Secure?

A candidate opens an online exam. The question appears on the screen.

Within seconds, that same question can be shared with an AI tool. The candidate receives an answer, reviews it, and submits a response.

That scenario changes the security challenge for online assessments.

ChatGPT and other AI tools can process text, images, code, and complex questions in seconds. For an assessment organization, the concern extends beyond whether a candidate can open another website.

The more important question is whether the exam environment can protect assessment content, control access to unauthorized resources, and detect attempts to use AI assistance during an exam.

In an era where AI can generate answers almost instantly, securing the testing environment requires a broader approach than traditional browser restrictions alone.

AI changes how candidates can access answers

Traditional online exam security has focused heavily controlling on activities such as:

Opening another browser tab
Visiting an unauthorized website
Copying and pasting text
Taking screenshots
Using keyboard shortcuts
Switching between windows

These controls still matter.

However, AI introduces another layer of complexity. Candidates may access browser-based AI tools, extensions, external applications, or a separate device to process exam content.

A question can be copied into an AI tool. A screenshot can be analyzed by an AI system. A browser extension can provide AI assistance without requiring a candidate to leave the exam browser.

The security challenge, therefore, involves two critical areas: protecting access to exam content and identifying attempts to use unauthorized assistance.

Can a lockdown browser prevent ChatGPT use?

A lockdown browser can restrict many of the normal ways a candidate might reach ChatGPT during an exam.

For example, browser controls can restrict unauthorized URLs, prevent new tabs, block copy and paste, disable certain keyboard shortcuts, and force the candidate into full-screen mode.

ExamLock uses these types of controls as part of its secure exam environment. Its system also includes controls for screen capture, virtual machines, external connections, and AI/GPT browser extensions.

ExamLock Lite takes a browser-extension approach. It restricts additional tabs, blocks shortcuts such as copy, paste and Print Screen, forces full-screen mode, limits access to authorized URLs, and checks for AI-enabled browser extensions before an exam begins.

These controls can reduce direct access to browser-based AI assistance.

The important detail is how the security controls work together.

The AI problem starts before the answer is generated

Consider a simple online exam question:

Explain the difference between formative and summative assessment.

A candidate could attempt to:

Copy the question.
Open an AI service.
Paste the question.
Generate an answer.
Return to the exam.
Submit the response.

Browser restrictions can address several steps in that sequence.

If copy and paste are blocked, the candidate loses one easy way to transfer the question. If unauthorized URLs are restricted, direct access to AI websites can be blocked. If additional tabs are restricted, the candidate cannot simply open a second tab beside the exam.

AI browser extensions create another concern. An extension can place AI assistance inside the browser environment itself.

That is why ExamLock Lite includes AI extension detection alongside tab restrictions, URL controls, full-screen mode, shortcut blocking, and activity monitoring.

The question can leave the browser in other ways

Online exam security also needs to consider the device surrounding the browser.

A candidate may have access to:

A second monitor
A virtual machine
External devices
Screen recording software
Screen mirroring
Bluetooth connections
Another internet-connected device

ExamLock includes controls and detection capabilities for several of these areas, including dual monitors, virtual machines, USB/HDMI/VGA connections, Bluetooth, Wi-Fi tethering, screen recording, and screen mirroring.

This matters because the exam question exists as information on a screen. Security controls need to consider the ways that information can be accessed, copied, transmitted, or processed.

What happens when AI is built into the browser?

This is becoming a particularly relevant issue for assessment teams.

AI assistance does not always require a candidate to navigate to a separate AI website. It can be delivered through browser extensions and other browser-level tools, allowing AI capabilities to operate within or alongside the exam environment.

A security strategy that only on restricting access to a list of websites can therefore leave part of the security challenge unaddressed.

ExamLock Lite checks for AI-enabled browser extensions before candidates begins an exams. ExamLock also includes AI/GPT extension detection as part of its broader exam security controls.

For assessment administrators, this raises a practical question:

Which browser extensions and applications should be permitted during an exam, and which should be restricted?

That policy should be defined before the assessment begins and enforced consistently throughout the testing experience.

Exam security needs clear rules as well as technology

Technology controls are most effective when candidates understand what is permitted and what is prohibited.

Before an assessment begins, organizations should clearly define:

Whether AI assistance is permitted.
Which external resources candidates may access.
Which browser extensions and applications are prohibited.
Whether calculators or other tools are allowed.
Whether candidates may use multiple displays.
What happens when a security restriction is triggered.
How suspected violations are documented and reviewed.

These policies become especially important as AI tools generate answers that can resemble ordinary candidate responses.

A flagged event should trigger a defined review process, not an automatic conclusion. The security system can identify suspicious activity and collect relevant evidence, while the assessment organization determines how that evidence should be evaluated and whether it affects the candidate's result.

Clear rules, reliable technology, and consistent review procedures work together to support assessment integrity.

AI also changes assessment design

Exam security doesn't end with browser controls.

Assessment designers can also consider how question design affects the usefulness of unauthorized AI assistance. Questions that require candidates to apply knowledge, explain decisions, or interpret specific information can provide additional ways to evaluate understanding.

For example, an assessment that include questions that require candidates to:

Applying a concept to a specific case
Explaining the reasoning behind a decision
Interpret information provided during the exam.
Show their work when completing a calculation.
Respond to scenario-specific information.
Demonstrate a practical process.

These formats can still be answered with AI, depending on the question, the available information, and the tools accessible to the candidate. They are not a replacement for exam security controls.

Effective assessment design and secure exam delivery should work together. The assessment format, delivery environment, and security policies should be considered as part of a comprehensive approach to protecting exam integrity.

So, is an online exam secure if ChatGPT can see the question?

The answer depends on the controls surrounding the exam.

If unauthorized AI access is possible through another browser tab, an unapproved extension, copy and paste, screenshots, another application, or another connected device, the assessment faces additional security risk.

A secure testing environment needs controls that address how candidates can access, and transfer exam content.

ExamLock approaches this through layered controls across the browser and device environment. Depending on the deployment, those controls include URL restrictions, tab controls, shortcut blocking, full-screen enforcement, AI extension detection, screen-capture controls, virtual-machine detection, external-device detection, and activity monitoring.

No single security control can address every possible form of unauthorized assistance. Assessment organizations need a combination of appropriate technology, clear candidate policies, thoughtful assessment design, and a defined review process.

The question assessment teams should ask now

AI has made answer generation faster and more accessible. That creates a practical security question for assessment teams:

When an exam question appears on a candidate's screen, what controls prevent that information from reaching an unauthorized AI tool?

The answer should be specific.

Can the candidate open another tab?
Can they access an unauthorized URL?
Can they copy the question?
Can an AI browser extension operate during the exam?
Can they capture the screen?
Can they switch to another window?
Can they use a second monitor?
Can they run a virtual machine?
Can they connect another device?

Every unanswered question represents a security consideration for the assessment program.

For organizations delivering high-stakes online exams, AI makes these considerations increasingly important. The exam environment must account for how candidates can access, capture, transfer, and process exam content while the assessment is in progress.

Exam security starts with controlling the environment in which the question is seen.

If you're reviewing your online exam security, explore how ExamLock can help protect your assessments.