Artifacts use a messaging system from the sandboxed IFRAME back to the hosting page can communicate directly with the instance. That is how they can store/retrieve user data and get username/avatar template etc…
Implementation is here: discourse-ai/app/controllers/discourse_ai/ai_bot/artifacts_controller.rb at main · discourse/discourse-ai · GitHub