Of the two examples given, the second apologised and clarified that they had intended those posts for their fork and the spamming was accidental. They took action to correct the error, so I am unclear that a specific policy about automation would have improved that situation.

More generally, how do you practically distinguish between someone running an AI bot and someone repeatedly copy/pasting AI output as described in the first paragraph? If the comments are coming too fast to realistically be from a human, then I think that comes under GitHub’s existing spamming rules.

It would not have prevented the situation in the second case, but it gives me reference point to explain their wrong-doing without having to write much manual text. I also do not see a significant difference between accidental and intentional spamming. Both cases result in extra work on our side. If you run agents it's your responsibility to control them (e.g. possibly do test runs). They have spammed several repositories over multiple days.

Distinguishing: First of all, I want to be very explicit on unacceptable behavior. How to dect/distinguish is the second step. Some cases will be obvious, others won't. I've intentionally written "we reserve the right" and "we may". Thus, there is no atuomatism and we can do a case-by-case decision. In unclear cases we can start with "we have the impresssion that ..." / "it seems that ..." - "please make sure to comply with our AI policy".