mystery tags which I didn’t add – vulnerability?

The answer is that these tags are created as part of the unit-test suite of json-api WP plugin:

https://github.com/dphiffer/wp-json-api

https://wordpress.org/plugins/json-api/