Bright Data, previously known as Luminati, operates what it describes as the world’s largest residential proxy network, with over 400 million residential IP addresses. A significant portion of this network is powered through an SDK embedded in free consumer apps, activated through an opt-in process.
The findings, released on June 5 by Include Security and independent researcher Buchodi, raise growing concerns around privacy and transparency in data routing systems.
According to the report, the SDK can route scraping traffic through a user’s home internet connection. While it does not directly access personal files or data, it effectively turns unused bandwidth into a relay channel for external traffic.
Researchers also noted that the peer-to-peer channel handling this traffic lacks strong authentication. On iOS devices, the traffic may bypass VPN configurations and remain largely invisible to standard monitoring tools, continuing in the background as long as the device stays powered.
A key concern highlighted is the gap between user consent language and actual system behavior. Some apps suggest occasional usage, while testing indicates the SDK can generate up to 200 GB of monthly proxy traffic.
The model has grown rapidly with the rise of AI, as companies seek residential IPs to avoid bot detection systems that block data center traffic.
Experts recommend network-level protections like Pi-hole or NextDNS to monitor and block such hidden proxy connections.
