Japan's "Draw Live" Rule Is Coming for GitHub Hiring

A mid-sized Japanese game studio, profiled by Automaton Media and Daily Shincho on December 3, 2025, now asks art candidates to draw live in front of interviewers. They only added the step after several hires turned out to have AI-generated portfolios and could not do the work once employed. Engineering hiring is one quarter behind the same story, and the numbers are already ugly.

Why the Japanese studio story matters to engineering hiring

The "draw live" rule is not about interview cheating. It is about post-hire failure, which is where the money actually leaks. The anonymous chief designer known as "B" told Automaton that applicants "were hired, only to be found guilty of using generative AI when they couldn't make significant contributions with their actual skills." That is the exact phrase every engineering manager will recognize from week 6 of a bad senior hire: the PR is fine, the debug session is not.

The engineering analog is already visible in the assessment data:

• Fabric evaluated 50,000+ candidates and saw cheating adoption climb from 15% in June 2025 to 35% in December 2025.
• HackerRank found 14% of candidates admit to using AI on online assessments and 83% said they would if they thought employers could not detect it.
• Codility reports 88% of students acknowledge using tools like ChatGPT for tests in 2025, up from 53% in 2024. That is the incoming junior pipeline.

Designer B also said "it feels like we've gone back in time, but it seems that there are several other companies doing the same thing." Substitute "GitHub take-home" for "portfolio" and you have the CoderPad State of Tech Hiring 2025 finding that 41% of companies now pair the async take-home with a live defense.

15% to 35%

What "verify GitHub candidate" actually means in December 2025

Verifying a GitHub candidate means checking that a human with the claimed skill level did the work over time, in public, with other humans reviewing it. A profile is not a portfolio; it is a court record, and you read it the way you read a court record.

The five signals that survive AI inflation:

1. Commit cadence over 12+ months. Bursts of green squares in the last 30 days on repos with zero issues are the tell. Real engineers have boring, uneven, multi-year cadence.
2. Issue conversations. AI writes code. It does not argue about tradeoffs in a thread with three other maintainers over eight weeks. Look at the "Issues" tab, not the pinned repos.
3. Code review history. Reviews given, not just PRs merged. Comments that name specific lines and propose alternatives are hard to fake at volume.
4. Contributions to repos the candidate does not own. External PRs into repositories with real maintainers who gate merges. A candidate with 40 external merged PRs across 8 org repos has passed 40 gates you did not have to design.
5. Consistency across surface area. The stack in their commits matches the stack on their resume matches the stack in their answers. Drift is the smell.

This is the exact gap Refolk closes at the sourcing stage: describe the person in plain English ("senior Go engineer with 3+ years of merged PRs into CNCF projects, based in the US") and Refolk returns a ranked shortlist built from GitHub, LinkedIn, and the open web in one pass, so the verification work starts on candidates who plausibly clear the bar.

What Refolk's index says about self-declared AI skills

Filtering candidates on self-declared "AI skills" is a dead end today. In Refolk's index of US Software, Senior, and Staff Software Engineers, almost nobody tags the tools at all.

Two things fall out of this table. First, sourcers who filter on "GitHub Copilot" as a skill are looking at a rounding-error slice of the pool, and the slice skews to a handful of large platforms (Microsoft, Google, LinkedIn, HashiCorp) where Copilot literacy is a branding move, not a signal of practice. Second, public open-source contribution as a self-declared skill has not lost ground to AI-tool self-branding. The 1.04x ratio says the honest signal (contribution history on repos with real reviewers) is not being drowned out by the AI-tool marketing signal. It is being drowned out by silence.

A profile is not a portfolio. It is a court record, and you read it the way you read a court record.

The cheating arms race you will not win

Detection tools are structurally losing. The mechanism is simple: proctoring vendors ship signatures, and overlay tools ship a patch the same week.

The current landscape:

• Cluely, Interview Coder, Leetcode Wizard run $20 to $50 a month. Cluely's founder Roy Lee is now a nameable protagonist in the arms race.
• They use GPU-level overlays (DirectX on Windows, Metal on macOS) to render AI answers in a layer screen sharing cannot capture.
• Six new tools of this kind appeared in 2025, plus at least three open-source clones.
• 59% of managers already assume someone is faking it during assessments.

That last number is the trap for legitimate candidates. When more than half of interviewers walk in assuming fraud, polished real work looks guilty by default. Your best applicants get flunked out because a good take-home submission now pattern-matches to Cluely output. Sourcers who understand this can position clean candidates around the suspicion, with prose like "here is the repo, here are the reviewers, here is the multi-year cadence, and here is a 30-minute defense slot on their calendar." That framing sells past a suspicious hiring manager in a way a resume bullet cannot.

The take-home is not dying, the async-only version is

The structured take-home followed by a live defense is the engineering version of "draw in front of us." That is the format winning in 2025, and it is the one that beats overlay tools without turning the funnel into a proctoring dystopia.

The shape:

• 1 to 4 hour async task, scoped tight, with a real README and a real repo.
• 30 to 45 minute synchronous defense: the candidate shares screen, walks the code, and answers "why this, not that" for every non-trivial decision.
• No leetcode. No timed puzzle. The defense session interrogates the artifact the candidate already produced.

Per CoderPad, 68% of companies now use take-homes (+12% year over year) and 41% run this hybrid format. The defense session is cheap for the employer (one senior engineer, 45 minutes) and expensive for a fraudster (they have to explain code they did not write, in real time, to someone who did write similar code). It also lets legitimate candidates prove out on their own artifact instead of on a stress-timed puzzle.

The Goldman Sachs pole of the debate matters too. Goldman has given engineers access to GitHub Copilot and Gemini Code Assist and even runs internal competitions to foster creative AI use. The right read is not "cheating vs. purity." It is "tool use is fine; the human has to be able to defend the artifact." Designer B's Japanese colleagues who pushed back and argued the company should hire AI experts instead are making the same argument. Both can be true: hire people who use the tools well, and verify they can defend the output.

A concrete verification workflow for the next 20 candidates

Verify GitHub candidates on a five-step workflow that takes under 15 minutes per profile and produces a written go/no-go you can defend to the hiring manager. Do it before the take-home, not after.

1. Anchor the identity. Match the GitHub handle to the LinkedIn profile to a third source (conference talk, blog, Stack Overflow, org membership). One-source identity is a red flag on its own now.
2. Read 24 months of commit graph, not 3. Sustained irregular activity beats a suspicious sprint.
3. Open three external PRs and read the review threads. If the candidate answered maintainer questions with substance, that is proof of skill no overlay tool provides.
4. Check one issue they filed. Did they diagnose, reproduce, propose? Or is it a one-line "doesn't work"?
5. Cross-check the stack. Repos in Rust, resume in Rust, LinkedIn skills in Rust. Drift across the three surfaces is the single strongest fraud signal in 2025.

What this means for the sourcing pitch

Frame candidates around the post-hire failure the hiring manager is quietly afraid of, not around volume. The Japanese studio changed its process because hires failed on the job, and that is the fear a good sourcer can address in one paragraph of a candidate brief.

The pitch that lands in December 2025:

• "Here is the repo the candidate maintains. 340 commits over 26 months, 47 merged PRs from 12 other contributors they reviewed."
• "Here are two external maintainers who merged their PRs. Both are reachable."
• "Here is a 45-minute defense slot on their calendar this week. Bring code."

That paragraph does more to sell a candidate today than any skills list, because it inverts the 59% assumption of fraud into evidence of practice. It is also the paragraph AI-inflated candidates cannot produce, which is the whole point.

FAQ

How do I tell if a GitHub profile is AI-inflated in under five minutes?

Check three things in order: the 24-month contribution graph for irregular sustained activity, the "Issues" tab for substantive multi-turn conversations, and one external PR for a real review thread with a maintainer who is not the candidate. If all three are thin or missing, treat the profile as decorative. Pinned repos with polished READMEs and no external contributors are the AI-portfolio equivalent of a too-perfect illustration.

Are proctoring tools worth paying for in 2025?

Not as a primary defense. Six new overlay-based cheating tools plus three open-source clones shipped in 2025, and they render answers in a GPU layer screen sharing cannot capture. Detection will always lag one to two patches behind. Spend the budget on a 30 to 45 minute live defense session instead, which forces the candidate to explain their own artifact and cannot be beaten by an overlay.

Should I filter candidates on "GitHub Copilot" as a listed skill?

No. In Refolk's index of 521,450 US Software, Senior, and Staff Software Engineers, only 1,102 (0.21%) list GitHub Copilot as a skill, and they cluster at Microsoft, Google, LinkedIn, and HashiCorp. Filtering there hands you a marketing slice, not a competence slice. Filter on contribution history to repos with real reviewers instead.

What is the right take-home format when 35% of candidates are cheating?

A 1 to 4 hour async task followed by a 30 to 45 minute live defense session, which is the format 41% of companies now use according to CoderPad. The async part lets legitimate candidates produce real work on their own time; the defense session lets you interrogate the artifact in real time. It is the engineering version of the Japanese studio's "draw in front of us" rule, and it survives the overlay-tool arms race because it does not depend on detection at all.