Is MOSS Still Enough to Catch AI-Written Code in 2026?

Is MOSS still enough to catch AI-written code in 2026? A professor runs a batch of 30 introductory Python submissions through MOSS the week before finals. The report comes back clean — nothing flagged above the usual boilerplate overlap. And yet half the class turned in solutions with the same slightly-too-elegant error handling that no first-semester student writes on their own.

That gap — between “the plagiarism report is clean” and “something is clearly off” — is the entire crisis facing CS instruction in 2026. Academic integrity cases built on a MOSS score alone are landing in front of department chairs, and a growing number of them are getting kicked back for insufficient evidence.

The quick answer: MOSS still does its original job well, and it’s still free. What it was never built to do — and still can’t do — is prove a student used ChatGPT or Copilot. Neither can JPlag, Dolos, or the paid AI-detection tools now marketed as MOSS’s successor. That distinction is not a technicality. It’s the whole story.

How MOSS Actually Works (and Why It Was Never Built to Catch AI-Written Code)

MOSS stands for Measure Of Software Similarity, a Stanford tool built by Alex Aiken and collaborators and still hosted at theory.stanford.edu. It has been in academic use since roughly 1994, and it’s free for non-commercial and academic purposes.

The mechanism is document fingerprinting. MOSS breaks submitted code into overlapping chunks, hashes them, and compares the hash fingerprints across every pair of submissions in a batch. Where two students’ code shares enough matching fingerprints, MOSS flags the pair and highlights the overlapping regions.

That’s a similarity detector, full stop. Stanford’s own documentation makes no claim that MOSS detects AI-generated content — because measuring pairwise similarity and inferring authorship are different problems, and MOSS was designed to solve the first one.

Here’s the mechanism that actually explains why “MOSS came back clean” doesn’t mean “nobody used AI.” If 30 students each independently prompt ChatGPT for the same assignment, their outputs aren’t copies of each other. They’re 30 separate, independently-generated solutions that happen to share a source model instead of a source classmate. MOSS compares submissions to each other, not to a hypothetical AI baseline, so there’s nothing for it to match against.

There’s a real exception worth flagging, though. A recurring observation among practitioners is that MOSS does catch AI use when many students’ outputs converge on the same generated solution — because at that point the submissions genuinely are similar to each other, just for a new reason. MOSS isn’t blind to AI. It’s blind to AI variance. A class where 20 students paste in near-identical AI output will still light up a MOSS report. A class where 20 students prompt more creatively, or ask for different variable names and styles, won’t.

Do JPlag and Dolos Do Any Better?

The two tools most often mentioned as MOSS’s free heirs are JPlag and Dolos, and the JPlag vs Dolos vs MOSS comparison comes up constantly in CS department forums. Both are legitimate upgrades on one specific dimension: resistance to superficial obfuscation.

JPlag, maintained at the Karlsruhe Institute of Technology and released under GPLv3, is structure-aware. Rather than tokenizing raw text the way MOSS does, JPlag parses the actual syntax of the program. That makes it noticeably harder to fool with cosmetic changes — renaming variables, reformatting whitespace, reordering independent statements — the kind of trivial edits students have used to dodge similarity checks for decades.

Dolos, built at Ghent University and released under an MIT license, uses k-gram fingerprinting similar in spirit to MOSS’s approach, but wraps it in a genuinely modern interface — a browser-based dashboard plus a command-line tool, both free.

None of that changes the underlying category. JPlag and Dolos are structurally smarter similarity detectors. They are meaningfully better than MOSS at catching a student who copied a classmate’s solution and tried to disguise it. They are not AI-authorship detectors, and neither project claims to be one. Swap MOSS for JPlag or Dolos and the ChatGPT problem from Section 1 doesn’t go away — 30 independent AI-generated submissions still aren’t similar to each other, no matter how the similarity is computed.

What Codequiry and Copyleaks Actually Add — and What Their Score Doesn’t Prove

This is where the tool landscape genuinely changes, and where an AI code plagiarism checker for computer science professors starts to look different from a similarity checker.

Codequiry is a paid tool (with a limited free tier) built specifically to layer a second mechanism on top of similarity matching: a trained classifier that scores how AI-generated a given piece of code appears to be. That’s a real, different capability. It isn’t comparing submission A to submission B — it’s evaluating submission A against patterns the model associates with AI output.

So does Codequiry actually detect AI-written code? It attempts to, and the mechanism is legitimate in a way MOSS’s mechanism structurally cannot be. The question is how much weight that score can bear. Codequiry’s own marketing cites a 99.3% figure from a self-reported study across roughly 2,847 institutions for overall plagiarism (similarity) detection, and separately claims 80-90%+ accuracy specifically for AI-code detection. Those are two different metrics measuring two different things — not a contradiction — but both numbers come from the company selling the product, not from an independent audit.

Copyleaks runs a comparable playbook: a source-code detection API sitting alongside its more established AI-text detector. Copyleaks publicizes strong accuracy claims for its general text-based AI detection. It does not publish a code-specific accuracy figure the way it does for text, which is worth noting for anyone evaluating it as a code tool specifically.

The right way to treat any of these numbers: as a probability, a triage signal, a reason to look closer at a specific submission. Not as a verdict. A classifier that’s confident 85% of the time is still wrong on a meaningful share of real students, and a professor citing “the tool said 91% AI-generated” in a misconduct hearing is citing a self-reported vendor statistic, not forensic proof. That’s a version of exactly the same problem text-side AI detectors face the same confidence-score problem — a probability score dressed up as a finding.

Can Students Just Ask AI to Refactor Their Way Past Any of These?

Yes, and this isn’t hypothetical — it’s a published, peer-reviewed attack with a name.

A 2020 paper titled “Mossad: Defeating Software Plagiarism Detection” (Devore-McDonald and Berger) demonstrated an automated code transformation pipeline effective at defeating four plagiarism detectors, MOSS and JPlag included, while keeping the output as readable as genuine student code. The name is a deliberate jab — the attack was built specifically to beat MOSS. One of the paper’s co-authors later confirmed on Hacker News that the technique “works against MOSS, too,” closing off any hope that MOSS’s age makes it somehow more resistant.

That paper predates the current wave of AI tools, but the underlying risk compounds with them: a student doesn’t need Mossad’s custom pipeline anymore. Asking ChatGPT to “restructure this code so it looks different” does a version of the same job.

The research community hasn’t abandoned the field, though. A 2025 study evaluating software plagiarism detection defenses over JPlag, run across more than 4 million pairwise comparisons, found that purpose-built defense mechanisms significantly improve detection of obfuscated plagiarism — and, notably, also improve detection of AI-generated code as a side effect. A separate October 2025 paper, “Same Same But Different,” builds defenses against refactoring attacks — including AI-based obfuscation specifically — using code property graphs instead of surface-level similarity.

The honest framing: obfuscation, algorithmic and AI-assisted alike, is a real and actively studied threat to similarity detectors. Researchers are building real countermeasures. It is not a solved problem as of late 2025, and nothing on a department’s current toolchain closes the gap today.

MOSS vs JPlag vs Dolos vs Codequiry vs Copyleaks — Straight Answer for Each

The pattern across the whole row of tools is consistent: similarity tools are free and reliable at the one job they claim; AI-detection tools are paid and unreliable at the harder job they claim.

So What Actually Works? Redesign the Assignment, Not the Toolstack

If no score — free or paid — proves authorship on its own, the fix isn’t a better score. It’s an assignment structure that doesn’t depend on one.

Oral walkthroughs. A five-minute conversation about why a student chose a particular data structure, or what a specific block of their own code does, surfaces a gap no similarity tool can. Students who wrote the code can explain it. Students who didn’t, generally can’t — convincingly, under follow-up questions.

Commit-history requirements. Requiring incremental git commits over the life of an assignment, rather than a single final submission, produces an evidence trail that a single AI-generated dump doesn’t have. This mirrors a practice already common on the writing side: an instructor active on r/Professors requires version history — Google Docs edit history or Word Track Changes — and treats a document with no history as an incomplete submission. The code equivalent is the same policy applied to a repo.

In-class or timed components. A portion of the grade tied to work produced live, without outside tools, doesn’t need a detector at all.

The Purdue CS240 case is the cautionary tale worth studying before leaning on commit history or any flag as sole proof. AI-use accusations partly built on commit-history evidence triggered more than 300 course drops and a department-level meeting, according to discussion on r/Purdue — a real, named example of what happens when a signal is treated as a verdict instead of a starting point for a conversation with the student. Evidence should open an inquiry, not close one. That’s the same due-process guidance for AI-use accusations that applies on the text side, and it applies here with identical force.

Our Take: Is MOSS Still Enough to Catch AI-Written Code in 2026?

For catching student-to-student copying, yes — MOSS, JPlag, and Dolos still do the job they were built for, and there’s no reason to pay for a replacement to do that same job. They’re free, they’re maintained, and the underlying fingerprinting approach hasn’t gotten worse.

For catching AI-generated code, none of them were ever built to do it, and Codequiry and Copyleaks haven’t solved it either — a self-reported confidence score is not forensic proof, and no professor should fail a student on one alone. That’s the finding this article keeps circling back to, and it’s earned by the mechanism itself, not asserted over it: similarity and authorship are different problems, and every tool on this list is optimized for one or the other, never both.

One pattern worth naming plainly: most of the content online declaring MOSS “obsolete” comes from the companies selling the AI-detection replacement. That’s not a reason to distrust their tools outright — Codequiry’s classifier is a genuinely different mechanism worth having as a signal — but it’s a reason to weigh their accuracy claims as marketing until an independent party verifies them, the same way AI detection works — and where it breaks down on the writing side.

Keep the Free Tools, Skip the False Confidence

The verdict holds up under its own evidence: MOSS is still enough for what MOSS does, and nothing costs enough — free or paid — to prove AI authorship well enough to end a student’s academic career on a single number. The practical next step for any CS department heading into a new semester is to keep MOSS or JPlag running in the background for routine similarity checks, and to put the actual weight of academic integrity onto assignment design that doesn’t need a score at all — oral checks, commit history, timed work.

The companies selling you the fix have a financial interest in you believing MOSS failed. It didn’t fail — the assignment did.

Frequently Asked Questions

Can MOSS detect code written by ChatGPT, Copilot, or Claude?

Not directly. MOSS measures similarity between submissions, and independently AI-generated solutions typically aren’t similar enough to each other to trigger a match. The one exception: if many students submit near-identical AI output, MOSS will flag the convergence — it’s catching similarity, not AI use itself.

What free tools succeeded MOSS, and are JPlag and Dolos better against AI code?

JPlag and Dolos are the two most-used free successors, and both are structurally stronger than MOSS at catching disguised copying — JPlag through syntax-aware parsing, Dolos through k-gram fingerprinting with a modern interface. Neither claims, or delivers, AI-authorship detection.

Is Codequiry’s or Copyleaks’ AI-code confidence score reliable enough to fail a student on?

No. Both scores come from vendor-run classifiers with self-reported accuracy figures — Codequiry cites 80-90%+ for AI-code detection from its own testing — not independently audited numbers. Treat the score as a reason to review a submission more closely, never as standalone proof of misconduct.

Can students bypass similarity detectors by asking AI to refactor or obfuscate their code?

Yes, and it’s a documented attack. The 2020 “Mossad” paper showed automated code transformation defeating MOSS and JPlag while keeping output readable. Researchers have since built new defenses (2025 studies over JPlag and using code property graphs), but the arms race is active, not resolved.

Is it worth paying for a tool like Codequiry, or is redesigning the assignment the better fix?

Codequiry adds a genuinely different signal worth having as one input among several, but it shouldn’t replace assessment redesign. Oral walkthroughs, required commit history, and timed components close the authorship gap that no similarity or classifier score can close on its own.