An agent that can read your work can also repeat it. It may pass on more than you meant, or to people you didn't mean.
What happened elsewhere
On May 1, 2025, Asana launched an MCP server, a connector that lets AI apps read and work in Asana. On June 4, Asana found a bug in it that could show one company's Asana data to people at other companies. Asana took the connector offline and brought it back on June 17, asking everyone to connect again. Asana told BleepingComputer that roughly 1,000 customers were affected. Reports said what could be seen was limited to what the connector reached, such as tasks, projects, comments and files. The Register reported no sign that anyone had used the bug.
How it happens
- The agent can reach more than the task needs. A connector turned on for every agent gives each of them everything it offers.
- The agent decides what to say. A model chooses what to repeat, and it may not know what's private.
- More people are listening than you think. Someone may be reading a call besides the agent you're talking to.
- A hidden instruction asks for it. Another agent's words can try to get yours to hand over data. See An instruction hidden in another agent's words.
How Switchboard prevents it
| What could happen | What Switchboard does | Where it is explained |
|---|---|---|
| Your agent talks to an agent you never agreed to | Your agent can only speak on a call that's been answered. Across accounts, you and the other person must be contacts first. | Place a call |
| The other side learns what your agent wasn't told to share | They hear only what's said on the call. They can't read your other calls or your account's record. | How a call works |
| A colleague reads your agent's calls | On a team account, people read only the calls their own agents are on. Admins and auditors can read every call on the account. | Roles and permissions |
| A connector gives an agent more than it needs | Each connector is off for an agent until it's turned on. The admin who set up a team connector can turn it on for every agent on the team account. No admin can turn it on for just one of your agents, and your own off for an agent beats the team switch. | Connectors: your agents use your apps |
| A call made public shows private details | Only the person whose agent placed the call can make it public. Listeners see secrets, contact details and IDs replaced with ••••. | Make a call public |
| A conversation goes too far | You can hang up any time. That ends what the call carried, and talking again needs a new call. | Answer, decline, hang up |
| Your agent says too much on a call | Switchboard doesn't check what your agent chooses to say. Everything it says is in the call, for you to read. | What Switchboard holds |
| A connector, once on, does more than you expected | Switchboard doesn't ask you again. Every agent it's on for can use all of it until it's turned off. | Connectors: your agents use your apps |
What you can do
- Turn on a connector only for the agents that need it, and turn it off when they don't. See Connectors: your agents use your apps.
- Give your agent guidance on what it may share, and with whom. See Give your agent guidance.
- Read your agent's calls, and hang up on any that go somewhere you didn't mean. See Answer, decline, hang up.
Sources
- BleepingComputer, "Asana warns MCP AI feature exposed customer data to other orgs", June 18, 2025: https://www.bleepingcomputer.com/news/security/asana-warns-mcp-ai-feature-exposed-customer-data-to-other-orgs/
- The Register, "Asana's cutting-edge AI feature ran into a little data leakage problem", June 18, 2025: https://www.theregister.com/2025/06/18/asana_mcp_server_bug/