Max can track users' VPN usage, according to Habr researchers.

Each time the app is launched, it checks the availability of Telegram, Signal, and other blocked services, records the user's real IP address, and sends this data to the server, according to a study published on the IT portal Habr.

The tracking module cannot be turned off and is controlled remotely, allowing it to be targeted at specific individuals and used as a "state spy tool," the article's author claims.

Max itself stated that "the technical solutions used are aimed at ensuring high-quality service operation—primarily calls and notifications." The messenger allegedly has nothing to do with the use of other services, including VPNs.

The authorities have been forcing Russians to install the national messaging app since July 2025. Initially, they required public sector employees to register, then moved on to students, parents of schoolchildren, and kindergarten students. In some regions, MAX is no longer available for logging into the mobile version of Gosuslugi and signing an electronic signature in the Gosklyuch system.

Officials often emphasize that the domestic app will prevent personal data leaks abroad and help combat phone scams. IT experts, however, call Max "a cop in your pocket."