Content integrity is a format problem · September 2026 update

Where does a business candidate’s time go?

An AI for Business task is built on real data. A team roster, a set of productivity scores, a company brief. That data is what makes a scenario resemble the job rather than a hypothetical, and reading it is part of the work.

Until August it lived in the AI Assistant’s context. The task description named the files, and a candidate got at the contents by asking the assistant for them. That worked, and it spent some of the session on retrieval.

The files now sit under the task description and open in a tab beside it. Anything with rows and columns opens as a table with a fixed header, so a 120-row roster can be read rather than scrolled through as raw text. The assistant also moved to the middle of the workspace, so the layout runs task description, then assistant, then response, which is the order the work actually happens in.

A candidate reads the situation, forms a view, and uses the assistant to pressure-test it. More of the session goes on the judgment the scenario was built to draw out.

One detail that connects back to the rest of this page: the files are served through the same gated route as the task description and carry the same copy and print restrictions. Opening the data did not open a way to take it away.

Why is the task statement the weakest part of an assessment?

Most of the effort in assessment integrity goes on watching the candidate. Proctoring, behavioral signals, similarity checks, risk scoring. All of it useful, and all of it pointed at the same moment: the session where someone is answering the question.

The question itself gets far less attention, and it is the part that leaks. A task statement is text. Text can be copied out of a session, posted on a forum, indexed, and eventually pasted into a model. From that point the task is measuring who found the post rather than who can do the work, and no amount of watching the candidate detects that, because nothing about their session looks unusual.

The industry’s answer has been to rotate content faster and hope the refresh rate stays ahead of the leak rate. That is a treadmill. It buys time without changing the underlying property that makes a task leak, which is that the problem exists as text at all.

This is the same argument as how you prevent cheating in coding assessments, pointed at content rather than at candidates: the durable fix changes the structure of the assessment rather than adding another thing to look for.

What changes when the problem is narrated instead of written?

Six of the most popular fundamental tasks now come as a video. The candidate watches a short lecture where the problem is explained and animated on a board, then solves it as normal.

There is no statement to copy out. Passing the problem around means transcribing it, which is real work rather than a keyboard shortcut, and effort is the only honest lever anyone has here. This does not make a task impossible to leak. Someone determined will sit down and write it out. It moves the cost of doing so from nothing to something.

Two properties matter as much as the format. Each video task is a genuine variant of the written task it came from, so the two can be swapped for each other or mixed inside one randomized assessment. And they sit in the same libraries as their written counterparts, so there is nothing new to learn and nothing new to buy.

Does an integrity signal help if nobody looks at it?

Two of the more telling signals in the platform now sit in a better place.

Device integrity comes from the Codility Desktop App, and is designed to surface tools that sit invisibly over a candidate’s screen and feed them answers without appearing in a screen share or a recording. Pattern detection looks for code that was retyped from a second screen or another device. Both worked. Both required somebody to open a session and go looking.

Most reviewers read one summary reading and move on, which meant those signals existed mainly for the people who already knew to check for them. Either one now raises the overall Integrity Risk band by itself, so a session worth a closer look says so on the summary. Whole batches of candidates can also be filtered by either signal from Test Mission Control or the Candidates page, so triage happens across a pipeline rather than one report at a time.

Raising a band surfaces a session for a person to look at. It is designed to point a reviewer at the right sessions rather than to decide anything on its own, and the underlying evidence is there to read.

What if your organization cannot permit AI at all?

Plenty cannot, and the honest answer used to be a list of settings and a promise that nothing new had been added underneath them.

Account settings now carry a single AI switch that sits above every individual AI setting. While it is off, every AI feature is off across the account, whatever the individual settings say, and a feature shipped later cannot arrive switched on underneath it. While it is on, each feature behaves exactly as it did before, so per-assessment choices work the way a team already uses them.

You cannot put a list of settings in front of a compliance review. You can put one switch in front of it. The point of the control is that a cautious organization can adopt the platform without adopting the AI, and can show which of the two it has done.

What arrives when Codility adds a new technology?

The other half of August was the library getting broader, and the way it got broader matters more than the list.

Playwright, Erlang and Clojure all arrived, and each one arrived complete rather than partial. The platform runs it. A set of ready-made tasks covers the immediate hiring need. Your own engineers can build tasks in it, in the task builder or through the task creation MCP server. That combination is now the standard shape for every new technology rather than a one-off, which means asking for one has a known outcome instead of an open-ended queue.

The reason to care about the process rather than the three names: an assessment library that only grows when a vendor decides to grow it will always lag the stacks people are actually hiring for. Fifty tasks arrived across the three, spread through the Starter, Core and Advanced libraries rather than parked at the premium end.

What else changed in August?

Three more releases worth knowing about, with the full detail in the changelog below.

• Business candidates can open the data behind their task. An AI for Business task is built on a roster, a set of scores, a company brief. Those files used to live only inside the assistant, so a candidate’s first job was prising the numbers out of it. They now open in a tab beside the brief, with spreadsheets laid out as a readable table.
• Personalized feedback found the employee. It had been sitting two clicks deep inside a report tab, well enough hidden that almost nobody read it. It now announces itself on the employee’s own profile, marked visible only to them, with a count of what they have not read.
• API keys can be rotated without downtime. An integration user can now hold several applications and several keys, so rotation runs as create, migrate, verify, revoke, with the integration up throughout.

What does this mean for how you run assessments?

The work of keeping an assessment trustworthy has been framed as a detection problem for a long time: watch harder, score the signals, flag the outliers. August moved a different lever. A narrated problem is harder to pass around than a written one because of what it is, not because of what anyone spotted. A signal that moves the summary reading gets acted on because of where it sits, not because a reviewer got more diligent.

Both are structural changes, and structural changes hold up when nobody is paying attention. That is the property worth optimizing for, because the alternative depends on sustained vigilance from people who have a pipeline to get through.

If you run Codility today, most of what is described here is already on. The AI features are the exception and start switched off, and an admin turns them on in account settings.

Everything that shipped in August

The complete record of the August 2026 releases, including the ones the article above does not cover.

Frequently asked questions