Asana's AI connector exposed customer data to other organizations
What happened
A logic flaw in Asana's new MCP server, which lets AI assistants read Asana data, meant some users could see tasks, projects, comments and files from other companies. Asana took it offline for about two weeks and notified roughly 1,000 potentially affected customers. It says the bug was not the result of an attack.
Asana launched its Model Context Protocol server, which lets AI assistants such as ChatGPT and Claude read and act on Asana data, on 1 May 2025. A logic flaw in how it kept customers' data separate meant that for about a month, some users could see project names, tasks, comments and files belonging to other organizations using the connector. Asana found the problem on 4 June. It said the bug was not the result of an attack.
How it happened
Leaky AI product: App flaw. A security flaw in an AI application, such as broken login or access checks, let someone reach data they should not have seen.
The software involved works with many AI models, so no single model maker was involved. The product was Asana MCP server, a type of AI-powered app.
Impact
Data was exposed. Data involved: internal documents. Many organizations were affected. Sources give a figure of 1,000.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 1 May 2025. It became public on 18 Jun 2025, 48 days later.
Asana took the MCP server offline from 5 to 17 June, fixed the flaw, reset connections and notified about 1,000 potentially affected customers, advising admins to review their logs.