CyberLoop

architecture diagram
depth ladder example

Inspiration

I'm a cybersecurity practitioner and over the last 2 years have completed 15+ interviews with top tech companies including Amazon, xAI, and TikTok. I took detailed notes on every question I could, every follow-up probe, and every scoring pattern I could observe. The problem? There's no way to practice these interviews realistically. Flashcards don't test your ability to think under pressure. Mock interviews with friends don't push you the way a trained bar raiser does. And existing AI tools are just chatbots. They don't listen to you talk, watch you code, or adapt their questions based on how deep your knowledge actually goes.

I niched down into the five cybersecurity domains I know best from my own career: incident response, detection engineering, digital forensics, SOC operations, and threat intelligence. Every question tree, depth probe, and scoring rubric is calibrated from real experience and real interview loops I've been through, not generic LLM-generated content. The behavioral questions are mapped to actual leadership principle frameworks used at companies like Amazon. The coding challenges use real Apache access logs with attack patterns I've investigated in production. This isn't a general-purpose interview bot. It's built by someone who's sat in both sides of the interview table and knows exactly what interviewers are looking for at each level.

I wanted to build what I wished existed: an AI interviewer that conducts real-company-style cybersecurity interviews with voice, vision, and adaptive depth, the same way a real human interviewer would.

This project was created for the purposes of entering the Gemini Live Agent Challenge hackathon.

What it does

CyberLoop is a real-time voice-based AI mock interview platform for cybersecurity roles. It supports three interview modes:

Live Coding — The candidate writes Python in a built-in Monaco editor to parse Apache access logs, identify suspicious IPs, and explain the attack chain. The agent watches them code, executes the script, analyzes the output with , and asks follow-up questions based on what they wrote.
Behavioral — Amazon bar raiser-style STAR interviews that push on "what did YOU do?", track I-vs-we ratio, and probe until they find the edge of your experience.
Technical Depth — A depth ladder system (L1 Foundational → L4 Principal) that adapts in real-time. If you give a senior-level answer to a junior question, it skips ahead. If you stall, it detects your ceiling and wraps up gracefully.

After the interview, CyberLoop generates a detailed report card with domain scores, strengths, areas to improve, missed concepts, and study recommendations. This is all powered by Gemini 2.5 Pro analyzing the full transcript.

How we built it

Voice Pipeline: Gemini 2.5 Flash native audio through the Live API, orchestrated with Google ADK's run_live() for bidirectional streaming. Browser audio captured via WebAudio API and AudioWorklet processors, encoded as PCM16, streamed over WebSocket.

Agent Architecture: Three concurrent async tasks — upstream (browser → Gemini), downstream (Gemini → browser), and tool events. The agent uses ADK FunctionTools: evaluate_and_continue() (merged scoring + depth advancement + next question in one round trip), get_next_question(), and end_interview().

Code Execution: A /run-code endpoint executes Python in a sandboxed subprocess with a 10-second timeout. When the candidate clicks Run, the output is sent to Gemini alongside a screen frame capture of the editor and terminal — Gemini uses both the text output and the visual screenshot to evaluate the candidate's code, referencing specific line numbers and output values in its spoken feedback.

Smart Probe Selection: 9 static depth probes ordered from basic to advanced. Before asking a probe, the system checks the candidate's transcript for concept coverage. If they already mentioned brute force, exfiltration, and persistence, those probes get skipped and it jumps to edge cases and optimization.

Report Engine: Gemini 2.5 Pro analyzes the full live transcript with mode-specific scoring rubrics (STAR for behavioral, code quality + security insight for coding, technical depth for technical interviews).

Stack: FastAPI + Python 3.12 backend, React 18 + Vite + TailwindCSS frontend, Monaco Editor for in-browser coding, deployed on Cloud Run.

Challenges we ran into

The 2-Minute Death Wall. Our sessions kept crashing with WebSocket errors 1008 and 1011 after about 60 seconds. After extensive debugging, we discovered that Gemini Live API has a hard 2-minute limit for audio+video sessions (vs 15 minutes for audio-only).

Every screen frame we sent classified the session as audio+video, filling the 128K context window at ~258 tokens/second. The fix: enabling context_window_compression with a sliding window of 20K tokens, which effectively removes the session duration limit. This was not well-documented and took hours to diagnose.

Everything Is a Prompt. Any data sent via send_content() in the Live API triggers the model to respond. Screen frames every 3 seconds? The agent talked constantly, narrating what it saw. Code text updates? It commented on every line. System instructions injected as content? It literally read them aloud ("STAY SILENT unless asked"). We learned that send_realtime() (audio) doesn't trigger responses, but send_content() (text/images) always does. Our solution: store screen frames silently and only inject code context through tool responses — the one place you can give the model information without triggering speech.

The Hallucinating Interviewer. The agent would ask a question, then immediately call the scoring tool with a fabricated summary of what the candidate "said" — scoring an imaginary answer and moving to the next question. The candidate hadn't even spoken yet. We built a two-layer guard: reject tool calls with responses under 15 characters, and cross-reference against actual transcribed speech from the audio stream.

30-Second Response Latency. After the candidate stopped talking, the agent took 30-40 seconds to respond. Root cause: three sequential tool call round trips through the Live API (score → advance → get next question). Each round trip added 5-15 seconds. We merged all three into a single evaluate_and_continue() tool, cutting it to one round trip and dropping response time to ~8 seconds.

Gemini Says Everything Twice. The model would generate the same question twice in one audio response — different phrasing but same content. We built semantic repetition detection that extracts key words from each sentence and mutes audio when 60%+ overlap is detected. The transcript flush also truncates to the first question only.

Transcription Degradation on Long Answers. After ~60-90 seconds of continuous speech, Gemini's input transcription loses coherence and starts outputting gibberish. The audio model still hears everything correctly (it responds appropriately), but the transcription sub-model breaks down. This is a Gemini Live API limitation we documented but couldn't fully solve.

Accomplishments that we're proud of

Built a fully functional voice + vision + code execution interview platform in a weekend - Solved the 2-minute audio+video session limit that isn't documented anywhere obvious — this is genuinely useful knowledge for anyone building with the Live API
The depth ladder system actually works: give a senior-level answer and it skips ahead; stall and it detects your ceiling - Smart probe skipping uses concept coverage analysis to avoid asking questions the candidate already answered
Mode-specific scoring rubrics mean a behavioral interview evaluates STAR structure while a coding interview evaluates code quality and security insight
The Run Code button creates a complete feedback loop: write code → execute → agent sees output → gives specific feedback referencing actual results
Question banks calibrated from 15+ real interview loops at Amazon, Tiktok, and other top companies ## What we learned
In the Gemini Live API, send_content() is fundamentally a conversation turn. There is no "silent context" mechanism. Plan your entire architecture around this constraint.
Context window compression is not optional for audio+video sessions. Without it, sessions die silently after 2 minutes.
Tool responses are the only way to inject data without triggering a spoken response. This is the key architectural insight for any Live API agent with tools.
Combining multiple sequential tool calls into one is a general optimization pattern. Each Live API round trip adds 5-15 seconds.
The transcription and audio generation are separate sub-models with different reliability characteristics. The voice model is solid; the transcription degrades on long continuous speech.
Real-time audio applications need aggressive deduplication at every layer — Gemini sends cumulative (not incremental) transcription events. ## What's next for CyberLoop To continue expanding on the project, I would consider the following ideas:
Something we haven't solved for yet is the ability to increase the speed at which the agent responds. Latency was tricky during this entire project.
Browser-based speech recognition as backup transcription to handle the long-answer degradation issue
Expand to more domains — cloud security, application security, GRC, penetration testing
Multi-round interview loops — simulate a full Amazon loop with 4-5 different interviewers across behavioral + technical
Candidate analytics dashboard — track improvement over time across multiple practice sessions
Community question bank — let practitioners contribute and calibrate questions from their own interview experiences