A team's assistant occasionally surfaces a fragment of another user's conversation. What has gone wrong?

Answer: B — Session state was not scoped per user — a session hygiene failure

Nothing was stolen; state was scoped too loosely, often via a shared cache key or a shared-context optimisation. It's a design failure, and in a regulated domain a disclosure.