Two people can install the same version of MAX and still receive different privacy behavior. An audit published by InterSecLab on September 24 found that VK’s servers can enable network checks, VPN restrictions and other functions for individual accounts without an app update or a visible settings change. The researchers also found no end-to-end encryption protecting messages from the service operator.
The report concerns MAX for Android, version 26.12.0, build 6664, examined between March and May 2026. Its strongest evidence comes from watching the application operate and comparing those observations with its code. It does not establish that a government agency used these capabilities against a particular person.
The important settings arrive from the server
A version number usually tells a reader which software was tested. Here, it tells only part of the story. InterSecLab found that account-specific server settings control functions including network probing, voice-message transcription and more detailed logging. The installed application contains the machinery; the server decides which parts to activate.
That distinction matters when comparing reassuring and alarming tests. A feature that stayed inactive on one research account may behave differently on another. It also limits the report itself: this is evidence about the tested build and accounts, not a measurement of every MAX installation today.
A reply stopped at a VPN warning
During an April test involving two accounts, one phone could not reply to a message. MAX displayed an instruction to disable the VPN, and changing chats or trying to dismiss the screen did not restore messaging.
The researchers then moved the VPN connection from the phone to a router. Messaging worked. Their analysis tied the restriction to detection of a VPN interface on the Android device, rather than an inference from the connection’s public IP address. That explains the different results: the router still carried the traffic through a tunnel, but the phone no longer exposed that local VPN interface.
This was a workaround for the observed check, not a way to make MAX messages confidential. A connection’s security and an application’s access rules answer different questions. Changing the route to a server does not change what that server can read.
The phone also becomes a network probe
When the relevant account setting was enabled, opening MAX or moving it into the background could trigger a report containing public-IP checks, VPN status, mobile-carrier information and tests of reachable internet services. The report describes checks against up to six external IP services.
A separate mechanism accepted a list of destinations from the server. In 26 days of recorded traffic, the researchers counted 19 contacts with its reporting destination, trace-flow[.]ru. One requested test concerned Apple’s push service, whose address was absent from the app’s code. That was a concrete clue that the destination list came from outside the installed application. InterSecLab linked the reporting endpoint to VK’s network and a certificate issued to VK LLC.
Encrypted transport does not hide messages from VK
The team captured readable message content inside MAX immediately before it entered the transport cryptography. Together with the protocol and code analysis, the report concludes that the service lacks end-to-end encryption: VK remains able to read message content. This does not mean every network observer can read the encrypted traffic.
The same distinction applies to contacts. During a fresh registration, the researchers observed names paired with actual phone numbers in the upload payload, rather than a privacy-preserving contact-discovery exchange. An earlier interpretation of one routine as hashing was, they found, a formatting operation. The concern is what MAX discloses to its operator, not a claim that the entire upload crosses the internet unencrypted.
What the audit did not find
InterSecLab identified code capable of listing installed applications, but it was not initialized in the examined build and lacked a required declared permission. That is not evidence that MAX collected the test phones’ full app inventories. The researchers also distinguish code paths from functions they actually saw run, and report no evidence of targeted use against a specific person.
For someone who must keep MAX available, the report suggests a separate Android profile or device to limit what is exposed alongside it. Such separation, and the tested router VPN workaround, do not add end-to-end encryption. The practical boundary is to keep sensitive conversations out of a service whose operator can read them; a working VPN alone does not move that boundary.
References
- InterSecLab. The Max Messenger: An Analysis of Russia’s State-Mandated Messaging Application. September 2026; published September 24. Android build and methodology, network probing, active VPN blocking, contact synchronization and limitations. Accessed September 25, 2026.
