Asana bug in new AI feature may have exposed data to other users for weeks

A bug in one of Asana's new AI features made user information accessible to other users for several weeks.

The company said the issue was resolved and it was not the result of a malicious hack. Instead, it appeared to be a logic flaw in its MCP (Model Context Protocol) server that was released on May 1, according to cybersecurity firm UpGuard (via BleepingComputer).

MCP is an open-source framework that enables AI assistants to interact with sites and apps. The introduction of Asana's...