In my large (120-ish) 100-level undergraduate class, I assign about 20-25 homework assignments that I set up in Canvas Quizzes.

I have set up the quizzes to allow multiple attempts, keeping the highest scores. Indeed, they are not just "open-book," I expect and encourage the students to use their notes. Furthermore, the quizzes pull the questions from question banks and shuffle the answers, so every individual attempt of one of the quizzes is different. And, I set the quizzes to show the results only once after each attempt, while hiding the correct answers. The theory is the students should look up what they missed and learn from the attempt, then try it again to improve.

I recently discovered that at least a few of my students have downloaded browser extensions for Canvas, which apparently allow them to see things in their versions of Canvas that I had hidden.

I am attaching screenshots the students sent to me. I have hidden the "assignments" list on the lefthand side of the home page, because the homepage (which I have set to the syllabus page) for the course lists all the assignments for the course in order. But as you can see from the screenshots, and from what the students have disclosed, the students navigate to "assignments" (again, which I have hidden) then selected the quiz (which I labeled "CFU 9"). When the students selected this, the browser pointed them to the assignment "submission" (see the URL).

I think the extensions allow them to see all previous attempts multiple times. Furthermore I fear that, perhaps, the browser extension may even autofill in the correct answers from previous attempts when the Canvas quiz calls up the same question from the question bank on a subsequent attempt.

This is cheating, right? If my understanding is right, these students are using a browser extension to hack Canvas quizzes to see answers on graded assignments.

On the one hand, setting up a browser extension that gives access to parts of Canvas the instructor has hidden seems pretty clearly to be a form of academic dishonesty and misconduct. On the other hand, I am unaware of and doubtful that my institution has even addressed this question (as so many at my institution are focused on harnessing AI and detecting/deterring problematic use of ChatGPT and similar.)

Has anyone run into this problem? Do you have ways to address it?

Thanks in advance.