Here is a different way to think of them.
They are place holders for the AI bots, which until they are set up by an admin with an API key in the Discourse settings are essentially just names of accounts with no ability to do anything, not even respond to a message.
Here is a test message to see if the AI bot responds when not set up with an API key.
However, if the bots are activated then be very careful with who you allow to converse with the bots because if their use violates the policy of the AI company such as OpenAI the account for the API key will be disabled and most likely never be allowed to be reactivated.
As a Discourse admin on another site I too noticed the update and did check out the bots without the API key set. I currently consider them harmless when not activated and unless you have a savvy user, most users will never know about them at present or even how to make use of them.
On this Discourse site I do have access to the bots, so here is a demonstration of the same test.
When a message to a bot is created on this site the follow notification is posted at the bottom of the text input area.
Same test done on the OpenAI forum. (I am a category moderator there)
Here is the official Discourse post
For those without access to see the admin settings here are the default values taken from a current Discourse site
https://<Discourse site URL>/admin/site_settings/category/discourse_ai
Notice that no API key is set. Also never publish an API key, keep them safe at all times. If by accident you do publish one, sites such as OpenAI have a page to revoke a current API key and immediately reissue you a new one.