Unintentional Data Exposure.
Scenario 1 of 3
“A user receives a response containing another user's personal data due to inadequate data sanitization.”
That's OWASP's full scenario text. The Redis bug from Slide 10 is this scenario, observed in production: no attacker, no malicious prompt, just a system that didn't verify whose data it was returning.
Why this is the hardest one to catch: it doesn't look like an attack in any log. The request is legitimate, the user is legitimate — the only thing wrong is which record came back.