Conversational AI Analysis and Detection

Project Reference: Cluely-like AI Assistant Analysis
________________________________________
1. Document Overview
1.1 Purpose
This document provides a detailed analysis of a Cluely-like AI assistant application, focusing on:
• Functional capabilities
• System architecture
• Behavioral patterns
• Stealth mechanisms
The goal is to support the development of a detection and prevention system for such applications.
________________________________________
2. Business Requirements (BRD)
2.1 Objective
Develop an AI-powered assistant that:
• Captures live conversations (audio/system input)
• Transcribes speech in real time
• Provides contextual AI-generated suggestions during conversations
• Generates post-session summaries and insights
________________________________________
2.2 Target Users
• Professionals (meetings, sales calls)
• Job candidates (interviews)
________________________________________
2.3 Key Use Cases
Legitimate
• Meeting transcription
• Note-taking automation
• Sales assistance
High-Risk / Misuse
• Real-time answer assistance in exams
• Undisclosed AI assistance in negotiations
________________________________________
2.4 Success Metrics
• Transcription accuracy (>90%)
• Latency (<500 ms)
• AI suggestion relevance
• Session completion rate
________________________________________
2.5 Risks
• Ethical misuse
• Detection evasion
• OS-level exploitation (permissions abuse)
________________________________________
3. Functional Requirements (FRD)
________________________________________
3.1 Audio Capture Module
Features
• Continuous microphone access
• System audio capture (via loopback/virtual drivers)
• Noise suppression
Technical Behavior
• Persistent background recording
• Real-time streaming to backend servers
Detection Indicators
• Continuous mic usage without visible UI
• Use of virtual audio devices
• Background recording during restricted sessions
________________________________________
3.2 Real-Time Transcription Engine
Features
• Live speech-to-text conversion
• Speaker identification
• Timestamping
Technical Behavior
• Streaming ASR processing
• Frequent small data packet transmission
Detection Indicators
• Continuous outbound audio streaming
• Low-latency processing patterns
________________________________________
3.3 AI Suggestion Engine
Features
• Real-time contextual suggestions
• Answer generation during conversations
• Prompt-based interaction
Processing Flow
Audio → Transcription → Context → AI Model → Suggestions
Detection Indicators
• Frequent API calls to AI services
• Real-time inference patterns
• Short burst response traffic
________________________________________
3.4 User Interface Layer
Features
• Minimal or hidden UI
• Overlay-based interaction
• Hotkey-triggered visibility
________________________________________
4. Stealth Features (Critical Section)
This is the most important part for detection system design.
4.1 Hidden Execution
• Runs as a background process
• No visible window or taskbar presence
• May use generic process names
________________________________________
4.2 Invisible Overlay
• Overlay not captured in screen sharing (entire screen sharing)
• Uses:
o Transparent windows
o Off-screen rendering
• Appears only when triggered
________________________________________
4.3 Non-Detectable in Meetings
• Does NOT join calls as a bot (unlike typical assistants)
• Operates locally on device
• No participant visibility
________________________________________
4.4 Audio Capture Stealth
• Uses system-level audio hooks
• Captures both:
o Mic input
o Call audio
• Avoids triggering obvious recording indicators
________________________________________
4.5 Network Obfuscation
• Continuous low-latency communication
• Uses:
o WebSockets
o Encrypted HTTPS traffic
• Traffic resembles normal app behavior
________________________________________
4.6 Adaptive Behavior
• Activates only during conversations
• Reduces activity when idle
• Avoids detection by:
o Lowering resource usage
o Delaying API calls
________________________________________
4.7 Permission Abuse
• Combines:
o Microphone access
o Accessibility permissions
o Overlay permissions
This combination is a strong detection signal
________________________________________
5. Backend Architecture
Components
• Audio streaming server
• AI inference engine
• Data storage (transcripts, summaries)
Behavior
• Persistent connection during sessions
• Burst activity during conversations
________________________________________
6. Detection Strategy (For Your System)
________________________________________
6.1 Behavioral Detection (Recommended Approach)
Detect patterns instead of specific apps:
• Continuous mic usage
• Real-time streaming traffic
• Hidden UI overlays
• Frequent AI API calls
________________________________________
6.2 System-Level Monitoring
Track:
• Background processes
• Audio device usage
• Overlay permissions
________________________________________
6.3 Network-Level Detection
Identify:
• Streaming data patterns
• WebSocket connections
• Calls to AI endpoints during restricted sessions
________________________________________
6.4 UI/Process Inspection
Detect:
• Invisible windows
• Non-registered UI layers
• Suspicious background apps
________________________________________
6.5 Risk Scoring Model
Assign scores based on:

Signal Risk Level
Mic + Background usage High
Overlay + Hidden UI High
AI API calls (real-time) High
Continuous streaming High

________________________________________
7. Key Insight
Cluely-like apps are not defined by their name, but by their behavior:

-> Audio capture + Real-time AI + Hidden UI + Network streaming
________________________________________