Researchers say VK can turn on Max surveillance for one account at a time
On 24 September the digital security lab InterSecLab published a technical study of Max, the messenger Russia has made mandatory on new phones. The central finding is not that the app collects a lot. It is that what the app collects can be changed for one account at a time, from VK's servers, with nothing showing in the interface and no update to install.
Two people can run the same build of Max and be running, in practice, different applications. Network probing, VPN detection, voice transcription and verbose logging are all server-side switches. That is the part of the report worth reading carefully, because it changes what a test of the app can prove: checking your own copy tells you what is on for you today, not what the app is capable of.
In short
- InterSecLab watched Max for nine weeks, reading its traffic from inside the app before encryption and checking the behaviour against the code.
- Surveillance features are toggled per account from the server, invisibly, with no app update.
- At launch the app reports the public IP, the mobile carrier, whether a VPN is running and which services are reachable.
- Max's security centre rejects the study. VK said in March that Max does not track VPN use at all.
What the researchers actually did
This matters more than usual, because Max has been the subject of a long run of anonymous claims and equally anonymous denials. InterSecLab, working with RKS Global, ran real accounts on Android build 26.12.0 (6664) from March to May 2026 and captured message content at the moment before it was encrypted, then checked what they saw against the application's own code. Publication came four months after the fieldwork ended, on 24 September.
That gap is worth stating plainly. The behaviour described is what the app did in spring, verified against the code as it stood then. Before publishing, the researchers say they put the findings to VK Group, MAX LLC, Apple, Google and the Council of the European Union. Only the EU replied.
The switches that are not in the settings
The report describes a configuration delivered from the server rather than chosen by the user. Whether the app probes the network, whether it looks for a VPN, whether voice messages are transcribed, how much it logs: each of these can be set for a single account or for many, and the interface gives no sign either way.
There is no way for a user to audit this from the outside. Independent testing can show what a given account is doing at a given moment, which is exactly what makes the finding awkward for everyone involved, including the researchers: a feature that is off during a test is not a feature that is absent.
| What the report documents | Detail |
|---|---|
| Network report at launch | Public IP looked up through up to six external services, carrier, VPN presence, reachability of a list of services including the state services portal |
| VPN detection | Checks the device itself; a VPN running on the router is not seen |
| Address book | Uploaded to VK in cleartext at registration, names paired with numbers, including people who never installed Max |
| Encryption | No end-to-end encryption; message content is readable on VK's servers |
| Voice messages | Transcribed on VK's servers, not on the device |
| Lookup by phone number | Returns account id, display name and creation time; online status began streaming 1.2 seconds later, with no notice to the person looked up |
The VPN part, and why it is specific
Two things in the report concern VPNs directly, and they are different in kind. The first is passive: a flag in the network report saying whether a tunnel is up. The second is active. The researchers describe an attempt to reply to a message producing a full-screen instruction to disable the VPN, with no way past it.
The detection looks at the device. A VPN running on the router, upstream of the phone, is not visible to it. We are describing how the check works, not recommending a way around a service's rules, and it is worth being blunt about the limits: a router tunnel changes what the app can see about your connection. It does nothing about an address book already uploaded, or about messages that were never encrypted end to end in the first place.
We covered the earlier round of this in May, when independent testers first reported VPN detection in Max. The new report is not a repeat: it names the lab, the build and the method, and it adds the part about per-account switching.
What VK says, then and now
Max's security centre rejected the study, saying the published material does not match how Max works and pointing at one item in particular: that Max has never had "secret chats", which in its telling discredits the whole thing. It also suggested the text might have been generated by AI. What it did not do is answer the specific technical claims about encryption, the address book, the network report or the server-side switches.
The more interesting statement is older. In March, after a post on Habr raised the same question, VK told Kommersant that Max does not track VPN use, and that IP data is used only to make calls work properly.
VK press service, Kommersant, 5 March 2026"Max does not send requests to WhatsApp and Telegram servers and does not track VPN use. Data on IP addresses is used only for calls to work correctly inside the messenger."
- The September report describes a VPN flag in the report the app sends at every launch, alongside the IP and the carrier.
- It also describes a full-screen prompt demanding the VPN be turned off before a message can be sent.
- Both statements can be literally true at different times if the feature is a server-side switch, which is precisely what the report claims.
What a reader outside Russia should take from this
The specific app is a Russian problem: Max is mandatory on new devices there, and both Apple and Google have since pulled it from their stores. The architecture is not a Russian problem. Server-side feature flags are ordinary engineering, used by nearly every large app to roll changes out gradually. The report does not describe exotic technology. It describes a normal mechanism pointed at a question users assume is settled by the version number on their phone.
That is the part worth carrying over to any app operating under a government mandate: what the binary does today is a weaker guarantee than it looks, and end-to-end encryption is the difference between a promise about behaviour and a property of the system. Max does not have it.
