- The tool powered by Asana AI had a bug that exposed user data to other users
- It was corrected after a month, but users should be on their care
The Popular Project Management Platform ASANA warns users that a newly introduced tool may have disclosed their data to others on the service
Search for safety experts Upguard noted in early May 2025, Asana introduced the model context protocol server (MCP), a tool that allows AI products such as Chatgpt or Copilot Interagisse with ASANA’s work graph.
This allows users to request information using natural language, manage their tasks and projects using AI and obtain real -time updates using the MCP standard.
One month of leaks
However, the tool was implemented with a bug that exposed data from ASANA bodies to other MCP users.
However, not all data were exposed because it was limited within the access range of each user.
However, given that many companies rely on Asana when managing important tasks and major projects, this could mean that sensitive information has been disclosed (such as project metadata, team details, discussions, downloaded and similar files).
Asana apparently discovered the bug on June 4, which means that the platform has disclosed data for a month – the company sends opinions with links to communication forms to affected organizations, but apart from that, it remains relatively silent on this subject.
We do not know if users have undergone significant damage as a result of this defect, but the company said Bleeping Compompute that he had an impact on around 1,000 customers. It has more than 130,000 paid customers from around the world, including, according to some sources, heavy strikers such as Spotify, Uber or Airbnb.
In all cases, users must examine the ASANA newspapers for MCP access, examination of the AI ​​generated AI and appear in Asana if they see information from a separate organization.
In addition, users are advised to define LLM integration with restricted access and at the break of automatic reconnection and bot pipelines at the moment.
