[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Asana Discloses Data Exposure Bug in MCP Server](/blog/asana-discloses-data-exposure-bug-in-mcp-server) Publish date July 2, 2026 {x} minute read # Asana Discloses Data Exposure Bug in MCP Server [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) On June 4, Asana identified a bug in its Model Context Protocol (MCP) server and took the server offline to investigate. While the incident was not the result of an external attack, the bug could have exposed data belonging to Asana MCP users to users in other accounts.  ## What Happened According to Asana’s disclosure, the bug “could have potentially exposed certain information from your Asana domain to other Asana MCP users.” Specifically, users leveraging the MCP interface—typically for LLM-powered chat interfaces—may have been able to access data from other organizations, but only within the “projects, teams, tasks, and other Asana objects” of the MCP user’s permissions. There is no indication that attackers exploited the bug or that other users actually viewed the information accessible through the MCP bug. Asana emphasizes: “This was not a result of a hack or malicious activity on our systems.”  ## Timeline and Response Asana responded quickly upon discovery of the bug: * **May 1**. Asana releases the MCP server. The bug appears to have been part of this initial release.  * **June 4**: The MCP bug was identified, Asana took the server offline, and resolved the code issue. They write: “Our incident responders and engineering teams acted immediately. As soon as the vulnerability was discovered on June 4, we took the MCP server down to investigate, contain the issue and prevent any further potential exposure. The bug in our code was then promptly resolved.” * **June 16**: Asana notified potentially affected customers–anyone with a user who used the MCP server. * **Ongoing**: Asana is working to bring the MCP server back online. Additionally, they have sent out a form for affected companies to contact them to get a list of all Asana users with the MCP servers who may have potentially had their data read by others. “As soon as the vulnerability was discovered, our teams immediately took the MCP server down and resolved the issue in our code,” the company wrote in its email to customers. Customers have been given the ability to request logs and metadata associated with their MCP users to determine whether cross-account data exposure may have occurred. Asana advises organizations to “review any information you may have accessed through the MCP server in recent weeks and immediately delete any data that does not belong to your organization." ### Asana’s Next Steps Asana reports that the MCP server will be reinstated “in the coming days,” but reconnection will be manual. “We want to ensure your team is aware of the issue we experienced, and that you have full control over when your Asana instance reconnects to the MCP server.” The company also confirmed that a formal post-mortem report is underway and will be available upon request when completed. ## Takeaways for Organizations Using LLM Integrations This incident highlights key lessons for any organization [integrating LLMs](https://www.upguard.com/blog/unmasking-shadow-ai) into sensitive workflows: 1. **Limit scope aggressively**: Ensure that context servers like MCP enforce strict tenant isolation and least-privilege access. 2. **Log everything**: Maintain granular logs of all requests, especially LLM-generated queries, to support forensic investigations. 3. **Manual oversight during reintroduction**: Automated reconnections or retraining pipelines should be paused when incidents arise. 4. **Treat internal bugs seriously**: As shown here, even internal software flaws can have real-world exposure consequences. > The takeaway for LLM and MCP integrations: know what's connected and vet it before you trust it. The UpGuard AI Security Center's AI Insights builds your team's understanding of AI tools and OAuth integration risks, and AI Risk Check (coming soon) will help you assess them, so a vendor's bug doesn't quietly become your data exposure.\ > \ > [Explore the AI Security Center →](https://www.upguard.com/solutions/ai-security) Asana’s transparency in handling the incident and proactive communication are commendable, but the episode underscores the risks inherent in LLM system design, especially when integrated with enterprise data platforms. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 14, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)