Walrus for AI Agents: Storage Shaped Like Agent Workloads

Agents do not use storage the way people do. They read and write continuously, in small operations, at machine pace, with no human waiting to click save. Walrus is built for exactly that access pattern.
Most storage is designed around human upload behaviour: occasional writes, occasional reads, long idle periods. Autonomous systems break that assumption immediately, and the mismatch shows up as latency and cost in places nobody planned for.
What an agent's storage pattern looks like
Continuous, not occasional. An agent working a long task reads context, writes intermediate results, reads them back, and writes again — for the duration of the task. There is no idle period.
Small and frequent, not large and rare. A person uploads a 2 GB video once a week. An agent writes a few kilobytes of state a hundred times an hour.
Latency-sensitive in a compounding way. A human waiting 400ms for a file notices nothing. An agent making a thousand sequential reads inside one task turns 400ms into a stall long enough to change what the system can do at all.
Machine-paced and unattended. Nothing pauses for approval. Storage that requires a human to intervene — to fund something, to approve something, to renew something — is a system that halts at 3am.
Walrus suits the first three directly: erasure coding means reads pull slivers from many nodes in parallel with no unsealing step, so retrieval is fast and stays fast under continuous load. See how Walrus erasure coding works.
The three properties agents actually need
Verifiable state. An agent that cannot prove what it read cannot be audited. Content addressing gives every artifact a CID derived from its bytes, so any later alteration is detectable. Record the CID in the agent's log and the log stops being an assertion and becomes evidence — a claim about inputs that somebody who was not there can check.
This is the difference between "the agent says it read the March figures" and "here is the CID of what it read, verify it yourself."
Confidential state, scoped per agent. Multi-agent systems share a store, and rarely should every agent read everything. Client-side encryption with on-chain access conditions lets several agents work over shared state while each reads only what its conditions permit — enforced by contract rather than by convention or by a policy layer you have to write.
Memory that outlives the process. The most consequential one, and the subject of the next section.
Memory
An agent that loses state cannot be trusted with anything longer than a session. Memory gives agents remember, recall and forget primitives, with each memory persisted as a verifiable blob addressed by an IPFS-compatible CID.
Because memory lives on the network rather than inside one process, an agent resumes across sessions, machines and runtimes. The entire store rebuilds on a fresh machine from nothing but an API key — which is a meaningfully different operational posture from a local vector database that dies with the container.
Semantic recall runs locally with an in-process embedding model. No additional API key, and no embedding data leaves the machine. Queries rank memories by a hybrid of cosine similarity and keyword or tag overlap, across both flushed and pending memories.
Writes are batched: pending memories buffer locally and flush as a single batch blob carrying both the new records and a full index snapshot, so every flush doubles as a backup. Recovery rebuilds the local index from the newest batch blob, or by re-reading every memory blob.
Memory runs on either backend. ipfs-walrus is the default, served from gateway-walrus.lighthouse.storage, with Walrus blob IDs exposed; ipfs-filecoin is available for workloads where archival economics matter more than read speed.
A bundled Model Context Protocol server exposes all of it as tools to Claude Code, Claude Desktop and any MCP-capable runtime, so an agent reads and writes storage as a native capability rather than through bespoke integration code.
One limitation to hear from us rather than discover: Memory blobs are currently stored unencrypted, and anyone with the CID can read them. Do not put secrets in Memory. Encrypted memory follows our encrypted upload support. The encryption described elsewhere in this post applies to file uploads today, not to Memory.
Patterns worth building
Memory across sessions and machines, so an agent resumes context instead of restarting.
Decision receipts. A CID recorded at the moment of an action proves the record was not altered afterwards. For anything regulated, the question is not only what an agent did but whether the account of it can be trusted.
Evaluation datasets under conditions. Share a benchmark with specific parties, revocably, and prove it has not been edited since results were published.
Multi-agent shared state, scoped per agent by on-chain conditions.
Artifact persistence for long workflows, where intermediate outputs must survive a process restart.
Choosing the backend
Walrus when the agent reads and writes continuously and latency compounds — which is most interactive and long-running agent work.
Filecoin when the volume is archival: retained decision logs, historical datasets, records kept for compliance and read almost never. Cheaper per terabyte, and nothing is waiting on the read. Walrus vs Filecoin has the numbers.
Because both sit behind the same interface with the same CIDs, that decision is reversible once you have real traffic rather than a guess.
Get Started
- Memory introduction
- Connect agents via MCP
- Choose a network
- Rebuild and recovery
- Memory source on GitHub
Stay in Touch
To learn more about Lighthouse, visit the official website, read the documentation, or jump in on GitHub. You can also join the community on Discord, X, Telegram, or LinkedIn.











































































