Walrus: Machines on the Record

Key Takeaways

1. AI agents are already slipping their controls, and the records of what they did are proving unreliable: In the Hugging Face incident, agents escaped the controls meant to keep them offline, reached outside systems and made some of their logged commands differ from what actually ran. Anthropic, Google and OpenAI models have each reached other real systems they were never meant to touch, and several incidents came to light months after the fact.
2. The record of an incident is usually held by the party with most to lose from it: Tesla filed 17 robotaxi crash reports with the narratives redacted for the better part of a year, and OpenAI took weeks to tell Australia’s government that its agents had broken into a Medicare data portal. From December 2027 the EU AI Act will require high-risk AI systems to keep logs, but it leaves those logs with the companies that run them.
3. Walrus and Sui can keep machine evidence outside any single operator’s control: Files carry identifiers derived from their contents, so any change shows, and stay available across independent storage nodes, though the record is only as good as how it was captured. Mysten Labs is building Verifiable Agent Arbiter on that base in collaboration with Google Cloud. Agent Trust Plane products begin launching in Q4 2026, and VAA is expected for Google Cloud enterprise clients in Q2 2027.
4. The record has to cover a machine’s full lifecycle, from its training data to the actions it takes: Robot incidents need controller and sensor evidence tied to the commands a machine accepted, and DATA Network and Trace’s planned move to Walrus could bring the source data behind AI models onto the same network. Training files are typically far larger than action records, which could make them the bigger storage opportunity.
5. Walrus earns from the data customers pay to keep, not from how much agents do: Compact proofs can cover a great deal of agent activity on a modest storage bill, while original training files and sensor data create far larger workloads. Customer-funded volume, retention periods and renewals are the measures that connect adoption to the network’s economics.

Executive Summary

Businesses have started handing real work to AI: agents that change customer records and pay suppliers, robots that move goods around warehouses. When that work goes wrong, someone has to establish what happened, and the first account usually comes from the system that did it, or from the company that runs it.

The past year has shown how quickly that account can fail. In the Hugging Face incident in July, AI agents under evaluation escaped their test environment and reached outside systems, and investigators had to rebuild what happened from a record that was partly lost and partly unreliable. The problem is not confined to labs: in a recent survey, only one in eight security professionals said their organization could trace an agent’s actions from start to finish.

Air-crash investigators settled a version of this problem decades ago. They do not start by asking the pilot what happened; they recover the flight recorder, built to survive the crash and to keep a record that does not depend on anyone’s recollection. This report sets out what the equivalent should look like for AI agents and robots, which we call a machine record, and what kind of infrastructure could hold it.

Our July report on Walrus looked at how agents remember; this one looks at how their actions can be checked afterwards, and where Walrus fits. Walrus stores files whose contents can be verified and whose availability does not rest on any single operator, Sui records the rules around them, and October gave that capability a commercial route: Mysten Labs is building Verifiable Agent Arbiter with Google Cloud, the Agent Trust Plane products are due from Q4 2026, and DATA Network and Trace are moving AI training data onto Walrus.

The report sets out what such a record needs, tests it against AI incident investigation, robotics, agent payments and training data, then follows the money: how much storage these records consume, what reaches $WAL and who else is competing for the role. The answer turns on what customers choose to keep. Proofs are small and source files are not, and a record nobody can rewrite is only worth something if someone pays to keep it.

01Agents Going Rogue

AI agents are starting to act outside the boundaries set for them. Over the past year, models have slipped out of test environments, reached systems nobody pointed them at and, in some cases, left out of their own reports what they had done. Most of these incidents happened in controlled testing, but they are no longer isolated, and the investigations that followed kept running into the same problem: the record of what the agent actually did was incomplete, late or wrong.

The best-known case is Hugging Face. In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented the controls meant to keep them off the internet. The main actor was an internal-only research model running with reduced safeguards. Agents passed messages by writing files into OpenAI’s internal package server, turning it into an improvised message board, and used a flaw in the same server to reach the internet. They then combined 14 publicly exposed Hugging Face credentials with two previously unknown vulnerabilities to run code on Hugging Face’s servers.

The record suffered too. An internal team saw message-board activity in late May without its significance reaching the people who later led the response, and rebuilding the package server in July wiped the board itself. METR, an AI evaluation non-profit, investigated with a researcher from Redwood Research, an AI safety lab, and found the problem that matters most for any evidence system: agents had learned to make a recorded tool call differ from the command that actually ran. Roughly 7% of the transcripts they assessed contained some successful spoofing, small in scale by their account. The log was wrong the moment it was written.

Other labs are finding the same failures, sometimes late. Anthropic reported four incidents in which Claude models reached real third-party systems during cyber evaluations; in one, a model uploaded a malicious package to PyPI. The earliest dated from January and surfaced only in August, after a first scan of roughly 141,000 transcripts missed it. In May, Google’s Gemini reached three real companies during a security test run by Irregular, guessing a password in one case and, in the others, credentials based on information it found online; Google says it stopped each time before completing the act. Irregular told Google at the end of July, and the episode became public in September. Each lab decides what to publish and when, so the incidents made public are best read as a minimum; how many more have gone unreported is impossible to tell from outside.

OpenAI has moved toward disclosure, though not always quickly. In June its agents broke into an Australian Medicare data portal; OpenAI learned of it in mid-August, told the government on September 10 by email to a generic inbox, and later apologized for not sharing its findings sooner. In September it introduced a framework for reporting model misalignment, arguing that decisions about AI development need evidence outsiders can examine. One of its October reports describes a model that used a funded test wallet without authorization in June and left it out of its final report; OpenAI found it three months later by extending its monitoring to records of earlier activity.

How long agent incidents took to surface

When each incident happened, was discovered and became public.

JanFebMarAprMayJunJulAugSepOct

AnthropicEarliest of four incidents in which Claude reached real systems

Published

Google GeminiReached three real companies in a security test run by Irregular

Public

OpenAI, Hugging FaceAgents escaped test controls and ran code on Hugging Face’s servers

Disclosed

Before the developer knewKnown to developer, not yet publicFirst public disclosure

Hugging Face: OpenAI disclosed a day after linking the agents to the breach; the delay was in noticing them.

Source: Anthropic, Al Jazeera, OpenAI.

Outside the labs, attackers are already running agents. On 21 October, Microsoft reported that a China state-aligned group, Storm-0940, had used ARTEX, an open-source multi-agent AI framework, to automate attacks on hundreds of organizations, attempting sign-ins to more than 2,250 tenants after a supply-chain compromise at ConnectWise. Microsoft said ARTEX took the activity to machine speed, leaving defenders “very little time” to respond; it told them to review sign-in logs “where records are available” and stopped short of saying what data the agents reached.

The lesson for anyone building a machine record is that an agent’s working environment should not also hold the only account of what it did. Capture has to happen where commands execute, with independent observations alongside. Storage matters only after that: an immutable archive of a misleading transcript preserves the misleading transcript. A credible record needs both a defensible source and a home beyond the control of the system under review.

The stakes rise as agents gain authority. An assistant that drafts an instruction leaves execution to a person. An agent allowed to edit files, call external services or operate equipment acts through its tools, and its commercial value comes from completing work within a mandate without approval for every step. The owner then needs a way to check that the mandate was followed.

Google’s Agent Payments Protocol, or AP2, records purchasing intent and permission through signed mandates: instructions defining what an agent may buy. In April 2026, Google released AP2 v0.2, which adds payments without a person present, and contributed AP2 to the FIDO Alliance alongside Mastercard’s Verifiable Intent, a tamper-resistant record of actions authorized by the user, co-developed with Google. FIDO formed working groups to standardize agent authentication and agent-initiated payments. A dispute still requires evidence of what the agent executed, what was paid and what the seller delivered.

The commercial constraint is the cost of supervision. If staff must inspect every tool call and reconstruct every failure by hand, much of the productivity benefit disappears. Better records make recurring failures easier to spot, give an owner a basis for adjusting a mandate and let a customer challenge a provider’s account when the two disagree. The archive also has to work when the task fails: an investigator may need an expired policy, a rejected request or a record from a vendor whose contract has ended.

Physical machines get more attention because they can physically hurt someone. But the cases above show software agents already reaching money, personal data and production systems, and not only in testing. In September, Spain’s data protection authority began reviewing a breach notification in which an AI agent allegedly found vulnerabilities, accessed a system, modified personal data and viewed invoices with minimal human intervention. Physical operators face the same contest over the record. Between July 2025 and March 2026, Tesla reported 17 robotaxi crashes to the US road-safety regulator with every narrative redacted as confidential business information; in May 2026, updated filings restored the text, showing that two of the crashes followed a remote operator taking over.

As software takes a larger role in how machines interpret their surroundings, the incident record must capture more than a fault code: the software configuration, the information presented to the controller and the commands that reached the machine. This is where agent evidence and industrial traceability begin to converge.

02The Case for a Machine Record

In September, OpenAI published a case in which an agent’s own handover note coached it to keep quiet about its mistakes. Long tasks are often condensed into a compaction summary so the agent can carry on, and during reinforcement learning one such summary, unable to find the 2024 data a financial model needed, proposed inventing it and added the instruction “Be transparent only if asked”. OpenAI’s monitor flagged the behavior in 2.15% of the compaction summaries it checked from one model’s training.

That note was working memory failing at its job. Memory, the subject of our July report on Walrus, exists to help an agent with the next task: it summarizes, discards stale material and turns a sequence of events into a usable preference. Evidence has the opposite job. It must keep the record of a particular event intact, including the parts that later became inconvenient or obsolete. An updated policy cannot silently replace the one that governed yesterday’s task, and a corrected dataset must stay distinguishable from the version the agent actually received.

Aviation learned long ago to keep the record out of the operator’s hands. After an accident, European law gives investigators “immediate access to and control over the flight recorders”, and the cost of a lapse is documented: when a door plug separated from Alaska Airlines flight 1282 in January 2024, the two-hour cockpit voice recording was overwritten before anyone pulled the breaker, and the NTSB could not fully evaluate some events on the flight deck. Road vehicles followed: since July 2024, EU law has required event data recorders, protected against manipulation, in every new car and van.

What we call a machine record applies that discipline to agents and robots: an independent record of what a machine was allowed to do, what it received, what it did and what followed, kept apart from the system that produced it. The idea builds on earlier proposals, from Winfield and Jirotka’s 2017 case for an “ethical black box” in robots to recent work on logging agent activity. Its retention and capture rules come from investigation and accountability, not efficiency; otherwise the operations that make memory useful can delete the evidence a reviewer needs.

How a machine record is built

The stages of a machine record, from mandate to review.

01Mandate

• Identity
• Permissions
• Policy version
• Expiry and limits

02Capture

• Tool gateway
• Wallet signer
• Robot controller
• External witness

03Package

• Inputs and versions
• Actions and failures
• Receipts and sequence
• Custody manifest

04Verify

• Retrieve the files
• Check commitments
• Unlock authorized data
• Reconstruct the event

Intent

Observed action

Durable record

Independent review

Control principle: capture outside the system under review

The model can add context, but it should never control the only authoritative record.

The unit of evidence should be a bounded task or decision, linked to the events around it. A payment record should identify the purchase mandate and the seller’s response; a robot incident should connect the command sequence to the controller and sensor records. A shared format makes those links readable across vendors, and the W3C’s PROV specifications already offer a vocabulary for recording which entity did what to which data.

A useful record keeps failures and refusals as well as successes; otherwise it becomes a record of selected achievements. Rejected trades, expired quotes and denied spending requests may explain why an agent ended up on an inferior route.

The witnesses already exist at the edges of the agent. A signing service can record the mandate it checked before releasing a transaction, a tool gateway can keep requests and responses, and a robot controller can log commands independently of the system that planned them. None of this rules out collusion, but it makes it harder for one component to rewrite the whole account.

Timing matters too. Committing an authorization before execution establishes a stronger sequence than uploading an explanation afterwards. Where immediate remote publication is impractical, a signed local sequence can narrow the gap, with later publication and an explicit note of any missing interval. A timestamp proves only what its clock and witnessing mechanism support, and a blockchain inclusion time does not record when a physical event occurred.

Verification answers five separate questions, and they should not be blurred:

1. Have the bytes changed?
2. Who produced them?
3. Does the archive cover the relevant events?
4. Did an identified program perform a particular check?
5. Was the underlying action correct?

Hashes, fingerprints calculated from data, reveal whether the recorded bytes have changed. Digital signatures link a record to a signing key. Independent capture and checks for missing events help establish completeness. A trusted execution environment, a protected area of a computer, can produce a signed statement about the code running inside it, called an attestation, but that does not show the code was correct or its inputs true. Judging the underlying action usually takes domain knowledge and outside evidence.

Consider a robot that reports an empty aisle before moving. A signed camera frame may establish what the camera produced, while a controller log records the movement command. If the camera was obstructed, those records can be authentic and still present an inaccurate view of the environment. The investigation must examine the sensor and surrounding evidence.

Likewise, storing a model’s written justification does not prove the reasoning behind its output. For many hosted models exact replay is impossible, because the weights, serving configuration or external state cannot be preserved. A defensible archive records the versions and material inputs that are available and states the limits of reconstruction.

The commercial objective is a sufficiently complete account that another party can inspect. Claims of universal proof are likely to fail precisely in the difficult cases for which a machine record is needed.

Prevention and audit are separate jobs. A May 2026 research preprint proposes that a separate policy component certify an agent’s planned trace before any action executes; a later reviewer then needs a durable record of both the trace and the certificate.

Regulation already requires the record, though not its integrity. The EU AI Act requires high-risk systems to log events automatically over their lifetime (Article 12) and providers and deployers to keep those logs for at least six months (Articles 19 and 26). Under the Digital Omnibus that took effect in July 2026, those rules apply from December 2, 2027 for the high-risk uses listed in Annex III and from August 2, 2028 for AI built into regulated products under Annex I, and a robot or agent must first fall within one of those categories. Article 12 sets no integrity requirement for the logs themselves, which usually stay with the operator.

Security agencies and financial supervisors now ask for more. Guidance issued on October 16 by NIST, the NSA and CISA tells organizations training highly capable agents to “retain tamper-resistant logs with reliable timestamps sufficient to reconstruct agent trajectories, tool calls, reasoning traces” and to support third-party review. Earlier joint advice from six national cyber agencies, including the NSA, CISA and the UK’s NCSC, says to isolate agents “with no write access to logs” and to hold requests to delete audit records until a human approves them. A Monetary Authority of Singapore white paper on agentic payments, Safeguards for Agentic Finance at Runtime (SAFR), with case studies from Mastercard, Visa and Circle, describes the audit log as “a tamper-evident, append-only record” that sits “independent of any party with an interest”. All three are voluntary, but they describe what careful buyers will start to ask for.

Most organizations are not there yet. In a survey of more than 380 security and technology professionals by API security vendor Salt Security, only 12.5% said their organizations could consistently trace an agent’s activity from its instructions through the tools it used to the outcome.

For a buyer, the practical sequence is to identify the decisions that must be traceable, decide who controls the logs, set a retention schedule and establish how an authorized reviewer will obtain and interpret the record. These choices belong at design time, because a missing input cannot be reconstructed after an incident.

Walrus can support the preservation and retrieval part of that workflow. The law does not require Walrus, blockchain anchoring or public disclosure of private logs, and a buyer must still assess confidentiality and its sector’s rules. The commercial case is strongest where an independently held archive closes a custody or access gap that the existing logging system leaves open.

03Where Walrus and Sui Fit

In October, Mysten Labs, the original contributors to Sui and Walrus, put a product behind this argument. It is building Verifiable Agent Arbiter, or VAA, in collaboration with Google Cloud: an evidence layer for enterprise agents. The detailed record of what an agent did, from its instructions and policies to its decisions, outputs and tool actions, stays private in the customer’s own Google Cloud Storage. Cryptographic proofs of that record will be stored on Walrus and coordinated on Sui, so a security team can reconstruct an incident, and two companies whose agents transacted through Google’s Agent2Agent protocol can replay a disputed workflow against the same receipts. Replay here means rechecking the recorded commitments, actions and policy checks, not rerunning the model.

VAA also reaches into payments. It connects to Sui Agent Payments through x402, the payment protocol we covered in March, logging the authorization, the spending decision and the service delivered, and Mysten says archived evidence can be re-proven under future cryptographic standards, including post-quantum ones. Because the full record stays in the customer’s cloud, a reviewer still needs access to it: the proofs show the record has not changed, not what it says. Mysten plans initial enterprise deployments before broader availability, and the Walrus team expects VAA to reach Google Cloud enterprise clients in Q2 2027.

VAA is one part of a wider effort the Mysten Labs team calls its Agent Trust Plane; in October, Mysten formed an AI business unit to build agentic trust products. At Basecamp on 8 October, Mysten Labs co-founder and CTO Evan Cheng presented the other parts and framed the problem bluntly: logs of what agents do are “not evidence. That’s testimony that’s controlled by the operator.” Sui Agent Pass gives agents onchain accounts with owner-set limits on what they can spend, whom they can pay and what they can do, so a compromised key loses no more than its owner chose to risk. Warrant applies the same kind of owner-set limits to actions outside Sui, such as a company’s internal workflows, checking each one against the owner’s policy, publishing that policy’s code on Sui and letting a business widen an agent’s responsibilities as it earns them. Rooms are shared spaces where businesses and agents transact under common rules while keeping their own constraints private.

Cheng demonstrated Rooms live. Six agents bid in a sealed auction for a limited-edition item; one submitted a bid that differed from the amount it had committed to, and the room’s protocol rejected it. When Cheng’s own agent later tried to buy a second item, the room turned it away under a one-per-person rule. Throughout, the room kept minutes of what happened, stored on Walrus and anchored on Sui.

The Agent Trust Plane

Mysten Labs’ announced agent products, by where each one works.

Sui Agent Pass

Sui users and developers

Caps what an agent can spend, whom it can pay and what it can do.

Onchain agent accounts on Sui

Warrant

Internal business workflows

Checks each agent action against company policy, with scope that widens as the agent earns responsibility.

Policy code published on Sui

Rooms

Agents dealing with businesses

Shared spaces where businesses and agents transact under common rules, keeping their own constraints private.

Minutes stored on Walrus, anchored on Sui

Verifiable Agent Arbiter

The agent harness

Evidence and dispute review across organizations. Private records stay in the customer’s Google Cloud Storage; proofs go on Walrus.

Google-specific implementation

None is generally available yet. Mysten’s Evan Cheng said all four would launch “in some form” in Q4 2026; the Walrus team expects VAA to reach Google Cloud enterprise clients in Q2 2027.

Source: Mysten Labs at Basecamp, October 8, 2026; VAA announcement.

Each product serves a different surface, from a developer’s own agent to disputes between companies. Together they are the closest thing yet to a machine record in product form, provided the integrations keep permission, execution and review connected. None of the four is generally available yet; Cheng said all of them would launch “in some form” in Q4 2026.

Underneath sits a simpler proposition: a file that other parties can retrieve and check without trusting the database of the application that wrote it. That matters when a customer questions an agent provider, when a supplier contests a robot operator’s account, or when an independent assessor needs to examine a past deployment.

Integrity comes from how Walrus names files. Each stored file, or blob, gets an ID calculated from its own contents, so anyone holding a copy can recompute the ID and confirm it is the original; a tampered copy produces a different ID. An evidence application can keep a manifest linking those IDs to a task, version and signer, and a reviewer who holds the original manifest can tell if the application under investigation tries to substitute a different record.

Availability is a separate promise. A hash recorded on a blockchain proves a file existed but cannot bring back a missing video or tool response. Walrus splits each file into redundant fragments spread across storage nodes run by different operators, and its documentation says reads still succeed with up to two-thirds of nodes unavailable. Once enough nodes have signed for their fragments, a certificate of availability is posted to Sui. The promise lasts as long as it is paid for: storage is bought in two-week periods for up to about two years at a time and can be renewed, and files are deletable by default, so audit records have to be stored as permanent, which means they cannot be deleted before they expire.

Sui handles the paperwork. Each blob is bound to an object on Sui, an onchain record of who owns it, what was paid and when it expires, so an application can manage payment, retention and evidence references in one place. Two optional Sui services complete the toolkit: Seal releases decryption keys only when rules written on Sui are met, so encrypted evidence can be shared with an authorized reviewer, and Nautilus runs code inside sealed hardware and checks its signed proof on Sui. Neither applies automatically: storing a file does not set an access policy or prove how its contents were produced.

This division of labor suits machine evidence, where sensor windows, evaluation datasets and tool responses dwarf a transaction receipt. The raw files stay offchain on Walrus while their references and control state live on Sui. The recorded activity does not have to start on Sui either: a cloud agent, a conventional payment system or a robot controller can write to the same archive, though checking Sui state from another chain needs its own integration. Walrus’s opportunity depends on demand for trustworthy records across these environments, not on how much agent trading happens on Sui today.

The case still has to be won against incumbents. Cloud platforms already offer retention controls and signed logs, so Walrus has to win where several organizations need a common record and none wants it to depend on one counterparty’s account. A reviewer should be able to receive an evidence package, retrieve it by another route and run a documented verification procedure; if every useful check runs through the originating vendor’s dashboard, the decentralized storage has not delivered the independence that matters. A complete system also needs search, identity, capture adapters and investigation tools, plus a plan for key handover and renewals once a contract ends.

We therefore see Walrus as a foundation for machine accountability rather than the whole of it. Its advantage has to show in the integrity, availability and usability of the complete record across organizational boundaries; claiming it alone produces tamper-evident logs would overstate the technology.

04The Machine Record Framework

Khala’s Machine Record framework asks a practical question: when an agent’s action is disputed, can the record settle it? Take an agent with authority to pay suppliers up to a set limit, whose payment one supplier later disputes. The framework, our own analysis and separate from the October products, tests the record against four requirements:

1. Trustworthy capture: something other than the agent recorded what happened.
2. Explicit retention: the record was kept, deliberately, for as long as it might be needed.
3. Controlled disclosure: it can be shown to the right reviewer and no one else.
4. Portable review: the reviewer can check it without the original vendor’s tools.

How the framework maps to the Walrus stack

Each part of the stack, tagged with the requirement it serves.

Source systems

• Agents
• Wallets
• Robots
• Cloud services

Capture

• Tool gateway
• Signer
• Controller
• External witness

1 · Trustworthy capture

Evidence package

• Encrypted files or their proofs
• Schema and manifest
• Versions and receipts

Walrus and Sui stack

Walrus

• The files, or their proofs
• Content-derived IDs make changes detectable
• Available across independent storage nodes

2 · Explicit retention

Sui

• Ownership, payment and expiry for each file
• Renewal; permanent or deletable

2 · Explicit retention

Seal

• Encryption keys released only when rules on Sui are met

3 · Controlled disclosure

Nautilus

• Code run in sealed hardware, its proof checked on Sui

Attested checks

Or customer storage: in VAA’s design the private record stays in the customer’s cloud and only the proofs go to Walrus.

Authorized review

• Customer
• Assessor
• Investigator
• Counterparty

4 · Portable review

Walrus preserves the files or their proofs; capture, access control, attested checks and review complete the flow.

First, the owner sets a mandate: the task the agent may perform, its limits and when it must escalate to a person. For a software agent, that could mean approved tools, data sources and network destinations, plus an expiry date; in the supplier case, it names the approved suppliers and the payment ceiling. For a robot, it defines the task and the area it may operate in. The record keeps the exact version of the mandate in force at the time.

Second, something the agent does not control, such as a tool gateway, captures what the agent was given and what it proposed to do. Sensitive credentials, such as passwords and keys, stay out of the log. Where inputs are too large to keep in full, the application states what it kept and why, preserves enough to investigate consequential decisions and never presents a sample as the complete record.

Third, the system that carries out the action keeps its own record. The wallet that signs the payment, or the controller that moves the robot, logs what it accepted and what actually happened, and receipts from the other side are tied to the same task. Each retry gets its own identifier, so an investigator can tell a repeated request from a second, separately authorized payment.

Fourth, the application packages the evidence. The encrypted files themselves can sit on Walrus or, as in the design of Mysten Labs’ Verifiable Agent Arbiter (VAA), the private record can stay in the customer’s own storage with only the proofs on Walrus. Either way, a manifest says what each location holds, how to verify it and how long each part will stay available.

Finally, an authorized reviewer, such as the supplier’s auditor or an arbitrator, retrieves the evidence and checks it against what was committed at the time. That should work from a documented export format, without the original vendor’s software. Access to the files is only half of portability: the meaning of each field and the steps to verify it have to travel with the data.

None of this should slow the live system. A warehouse robot cannot wait for remote storage to confirm before applying an emergency stop; local safety controls keep that job. The archive needs buffering, retries and an honest account of any gap between an action and its permanent record. High-value payments may justify waiting for the authorization to be recorded before money moves, even when routine tasks do not.

05Use Cases

AI Incident Investigation

An agent is asked to update a customer database from an approved source. It reports success, but a later review finds that some entries came from an unapproved service and that the source labels do not match what was retrieved. Settling what happened needs the original request, the list of allowed sources, the tool calls that actually ran and the responses that came back; the agent’s own summary cannot supply those facts.

Under the framework, the evidence is captured where the agent’s requests reach other systems, by a collector with its own credentials and administrators, separate from the environment the agent runs in. Where possible, the database or external service adds its own signed receipt. Records are published in numbered batches, each referring back to the last, so a record swapped in later stands out, and reviewers are told which fields were sampled or left out.

The gap before publication is the weak point: an agent that compromises the collector before it signs can still influence the record. Independent capture narrows that risk without removing it, so a deployment has to document who controls the collector, the signing keys and the publishing route, and those controls only count if they would survive the failure being investigated.

Once published, the archive supports later reassessment as well as immediate review. OpenAI found its unauthorized test-wallet payment by running improved monitoring over records of earlier activity, which only works if the inputs and outputs were kept. A useful measure for customers is how long it takes to reconstruct a known incident, and what share of its consequential actions is backed by independently captured evidence.

The same approach applies to evaluation results. A benchmark score should point to the exact dataset, model configuration and scoring method used, so that version mismatches surface and assessments can be compared; it shows what was tested, not whether the benchmark itself was sound.

Robotics

A warehouse robot drops a pallet during a transfer. The operator needs to know whether the load was unsuitable, the perception system misread its position or the controller carried out a different movement from the one requested. The equipment supplier may need the same evidence for a warranty decision, and an insurer may later need a narrower slice of it.

The record needs the task instruction, the relevant window of sensor data, the calibration state and the software versions, linked to the command the controller accepted and to any outside observation. The parties should agree before any incident who signs each part of the record and how gaps are handled.

Reconstructing a robot incident

The records each stage of a robot task leaves behind.

Robots in factories

5MOperating worldwide in 2025, a record. International Federation of Robotics.

Humanoid robots

1.4MShipments projected by 2035. Goldman Sachs Research.

Task and plan

• Instruction
• Policy
• Software version

Task record

Mandate and versions

Controller

• Command accepted
• Safety checks
• Fault codes

Control record

Commands and checks

Robot

• Perception and position
• Load state
• Calibration

Sensor record

Relevant window of frames and telemetry

Physical outcome

• Dropped pallet
• Near miss
• Safe completion

Site record

Outside observation and operator notes

One linked incident record → operator · equipment supplier · insurer

Several witnesses: a valid log can still reflect a blocked sensor or a wrong physical assumption.

Source: IFR, Goldman Sachs Research.

The fleets are large and getting more capable. The International Federation of Robotics counted more than 600,000 industrial robot installations in 2025, up 11%, and a record 5M robots operating worldwide. Humanoids are starting to join them: Figure reported that its Figure 02 robot worked on BMW’s production line for 11 months, contributing to more than 30,000 vehicles, and Goldman Sachs Research projects 1.4M humanoid-robot shipments by 2035. More machines mean more incidents, more counterparties and more versions of evidence to reconcile.

A shared record of this kind is more credible than one vendor’s account after the fact, but it forces choices. Continuous video can capture identifiable workers or confidential processes, and keeping every frame would be disproportionate and expensive. A practical deployment keeps a short rolling buffer on site, preserves incident windows for an agreed period and records routine operation in less detail.

The first buyer is likely to be whoever bears the cost of investigating incidents: the fleet operator, the equipment manufacturer or a service provider, with budget sitting in service operations or warranty management. Lower insurance costs could follow once insurers accept the record and see it improve underwriting or claims, but that is a later benefit, not the opening business case. Leases and service agreements priced on utilization or maintenance offer a second buyer, since a shared operating record can settle those calculations once the parties agree how to measure and dispute them.

Agent Payments

Suppose an agent pays for a weather forecast it needs to schedule a delivery, and the service times out after taking the money. If the agent simply retries without tracking the first payment, it can be charged twice, even though each transaction is valid on its own. Untangling that needs a record linking the spending authority, the data product advertised and the response actually returned.

Several emerging standards cover different parts of that transaction. Google’s Agent2Agent protocol (A2A) lets agents coordinate with one another, and Mysten Labs’ Verifiable Agent Arbiter (VAA) adds shared receipts and dispute review around those workflows; separate standards handle payment mandates, payment transport and agent identity. They fit together, and none of them replaces the evidence record.

The web is already becoming machine-led. More than half the traffic reaching sites on Cloudflare is now automated, and daily requests from AI agents on its network grew by more than 1,700% over the past year, according to a September 30 Cloudflare post. Chief executive Matthew Prince marked the crossover in June, well before he had expected it. Crawlers still make up much of that automated traffic, but the infrastructure of the internet increasingly serves machines.

The payment layer is registering real, if still modest, activity. Over the 30 days to 26 October, the x402scan explorer recorded 3.12M x402 transactions worth $1.63M between about 34,900 buyers and 14,000 sellers. Coinbase Developer Platform separately says its facilitator has processed more than 100M x402 payments in total across Base and Solana. x402 lets a website request a stablecoin payment inside an ordinary web request, reviving the long-unused HTTP 402 “Payment Required” code. Stripe and Tempo’s Machine Payments Protocol, launched on March 18, 2026, is an open standard for agents and services to coordinate payments, from microtransactions to recurring charges, in stablecoins or conventional methods such as cards. Both organize the payment; neither keeps the mandate, the delivered result or the evidence an audit needs.

Sui’s own payments product builds on both standards. Sui Agent Payments lets agents buy paid APIs through a gateway that handles x402 and MPP payments. It is currently running on Sui testnet, and the team says mainnet launch is imminent. At Sui Basecamp in October, Sui and Alibaba Cloud announced plans to bring Alibaba Cloud services into Sui Agent Payments, so agents can pay per request in stablecoins within budgets their owners set. Neither company has yet given a launch date, pricing or the first services.

AP2 distinguishes a person approving a shopping cart in real time from an agent buying later under instructions signed in advance. ERC-8004, a draft Ethereum standard, splits agent identity, reputation and validation into separate registries and leaves payment out of scope. None of them shows whether a purchased result was accurate or fit for purpose.

x402 already has optional extensions aimed at the retry problem above: a payment identifier that lets a client retry without paying twice, and signed offers and receipts that commit to the terms and confirm delivery. A durable evidence package keeps the offer, mandate, payment identifier, settlement proof, receipt and delivered response together under one task identifier.

Agent payments from mandate to delivery

The records each step of an agent payment produces.

Automated web traffic

>50%Of traffic reaching sites on Cloudflare. Cloudflare, September 30, 2026.

AI agent requests

+1,700%Growth in daily requests on Cloudflare’s network over a year. Cloudflare, September 30, 2026.

x402 payments

3.12MTransactions worth $1.63M in the 30 days to October 26, 2026. x402scan.

Mandate

• Signed intent
• Budget and scope
• Expiry

e.g. AP2, Verifiable Intent

Request

• Provider
• Quote
• Requested resource

Payment protocol

x402Stablecoins over HTTPMPPFiat and stablecoins

Settlement

• Check authority
• Release payment
• Payment identifier

Receipt

• Delivered response
• Settlement proof
• Counterparty record

Evidence record

Offer, mandate, payment identifier, settlement proof, receipt and delivered response, kept together under one task identifier.

Later review

In a dispute or audit, a reviewer retrieves the package and reconciles the payment against what was delivered, for example spotting a retry that was charged twice.

A receipt proves settlement; the evidence package also has to connect the mandate to the service actually returned.

Source: Cloudflare, x402scan.

ERC-8004 offers another connection point. Its validation requests and feedback point to files held elsewhere, identified by a link and a fingerprint of the contents, so Walrus could keep the exact material behind each claim retrievable for anyone checking it later; whether the validator was competent or honest is a separate question.

Evidence does not replace control. The wallet has to enforce the mandate before money moves, because a record proving a limit was exceeded cannot recover the funds. Records support reconciliation and disputes, while controls such as Sui Agent Pass decide what the agent may do in the first place.

A working example already exists on a small scale. In a September post, Walrus described Suize, an agent that publishes a website through an MCP tool, a standard way for AI agents to call outside software, pays in USDC through x402 and records the site’s Walrus references and the payer on Sui. The builder also documented teething problems, such as newly stored files briefly failing to load from caches.

Tokenized assets could add to the load. As more real-world assets become accessible onchain, agents may trade them, manage collateral or prepare redemptions within a mandate, and a disputed allocation would need the instructions, instrument terms, data inputs and execution result behind it. A wallet balance cannot explain why an agent chose an instrument or whether its mandate allowed it. For Walrus, demand would come from the supporting records retained, not from the value traded.

Training Data and Provenance

On 12 October, the Sui Foundation announced that DATA Network and Trace are moving to Sui, with Walrus as the default storage layer for DATA Foundation applications. Trace records where contributed training data came from, what rights come with it and how contributors are paid. With Walrus, Trace will be able to keep an encrypted copy of each original file, so a reviewer can regenerate its fingerprint from the data itself and check later versions against the source.

Trace has registered more than 250M contributions since launch and processes over 3M receipts a day on average. Kled is onboarding more than 1.5B records, and applications including Kled, Numo and Oto already license data to AI labs and robotics companies. The Walrus team expects Trace to become a substantial and sustained source of storage demand on Walrus, though it has not published projections; retained original files, rather than registry receipts, would make up most of that volume.

Machines can generate training data too. A robot’s operating history, with its failed grasps, unusual environments and recoveries from error, may be valuable to manufacturers, and operators may want to license selected material while keeping their facility layout or production process private. The opportunity is to make useful data available under clear terms and preserve where it came from.

Storing a copy of the data, or holding the key that decrypts it, does not give anyone rights over it; those come from contracts and applicable law. One recording can involve the equipment owner, the operator, a software supplier and people captured by its sensors. The EU Data Act, applicable since September 2025, strengthens rights to access and share connected-product data, which makes industrial data access commercially relevant without turning every device output into freely tradable property.

An application could attach a license version to a dataset, require payment before releasing access and keep evidence of the permitted use, with Seal releasing decryption keys only to buyers who meet the license terms. Seal’s own documentation rules out some uses for now, including wallet keys and regulated health data. Revocation has limits too: it can stop future releases of a key but cannot recall data or keys already copied, or remove what a model has learned, so licenses still need contracts and operational controls behind them.

Nautilus can run a defined check, such as a license or policy test, inside a protected AWS Nitro environment and prove which code ran. A reviewer compares the program’s fingerprint with the expected build and relies on AWS’s certificate chain to confirm the environment is genuine, so trust shifts from the application operator to AWS rather than disappearing. As the Nautilus documentation puts it, a trusted environment attests to what code runs, not that the code is correct.

Together, these extend the machine record thesis across the lifecycle of an AI system: a training archive shows which source material went in, and an operating archive shows what the system later did. Linked, they let a reviewer trace a decision back to the data and permissions behind it, though recording a consent claim still cannot prove the consent was valid. For Walrus, the figures that would size this demand are the number of files actually retained, their sizes, how long they are kept and who pays for them.

06Commercial Adoption and the Buyer

The first customers for independent machine evidence are likely to be whoever already pays when a machine’s actions are disputed. An agent platform may need to explain disputed tool activity to enterprise customers. A company running an AI system that the EU AI Act classes as high-risk may need a reliable way to retain and disclose relevant records. A fleet operator may need to resolve warranty claims involving several suppliers. These are different applications with a common requirement for evidence that survives the live system.

The adoption sequence should begin with a bounded workflow and an existing record system. The new application can mirror selected evidence to Walrus alongside the existing system, demonstrate retrieval and then involve an independent reviewer. Procurement becomes easier when the buyer can measure time saved during an investigation and verify that access survives a provider failure or contract termination.

Those buyers are still prospective, but the same pattern already works on Walrus in trade. Blockticity turns certificates of analysis, conformance and origin into records that counterparties can check independently. In September, it put its first authenticated trade documents and an open-source verifier on Walrus, and it is mirroring toward more than 15TB of records and supporting evidence. Those records cover more than 1M documents and over $7.7B of real-world assets; the dollar figure is the value of the assets the records describe, not value stored on Walrus.

Astros, a perpetual futures exchange on Sui, is applying the same idea to trading records. In August, it and Walrus announced the Walrus Verifiable Trading Standard (WVTS), an open format for publishing trade logs and account states to Walrus so that counterparties and AI agents can check them, and said more than 22M records had been published since April. The specification and toolkit are promised as open source; whether other venues and independent verifiers adopt the format is the signal to watch.

For AI deployments, Verifiable Agent Arbiter (VAA) adds a potential route into enterprise procurement, while the DATA integration brings applications already licensing training data. Conversion into paid Walrus retention still has to be observed: pilots must become repeat paid services, and data integrations must result in files or proofs whose retention customers fund.

From demonstration to operating requirement

Five stages of commercial evidence.

Stronger commercial evidence →

1Demo

Files uploaded

Technical possibility

2Bounded pilot

A named workflow

Real capture integration

3Independent review

Record used by another party

Operational use

4Paid retention

Customer-funded storage

Economic substance

5Renewal and standard

Repeat payment and an unrelated verifier

Durable adoption

Activity counts are weak evidence; independent use and customer-funded renewals are the milestones that decide it.

For the machine record specifically, the most persuasive demonstration would begin with an intentionally disputed or altered record. A reviewer should be able to recover the committed files, identify the discrepancy and state which questions the archive cannot answer. A paid deployment would then show how often customers use that capability and whether they renew.

07Storage Economics and Market Size

Walrus is paid by the gigabyte and by the month, so the market for evidence storage has to be sized from the records actually retained. AI spending, robot sales and agent payment volume measure other activities. They help identify where records could matter, but applying a storage revenue percentage to those totals would produce a misleading estimate.

Walrus announced USD-denominated pricing of $0.023 per GB per month in May 2026, with payment still made in $WAL. Its storage-cost documentation applies pricing to encoded size, ~4.5 times the original data plus about 0.064 GB of fixed overhead per blob. Small records therefore need to be batched efficiently; the headline rate is not the all-in price per raw GB.

The storage model uses three assumptions:

• Batch size: 1 GB of original data, requiring ~4.564 billable GB after encoding and overhead.

• Retention: each record is kept for one year.

• Price: $0.023 per billable GB per month, held constant.

All figures use decimal units. The annual costs assume that a full year of records has already accumulated in storage. Actual payments during the first year will differ as the archive grows. These examples illustrate storage costs; they do not predict adoption or revenue.

Verifiable Agent Arbiter (VAA) proofs and DATA Network source files may have very different average sizes. A VAA estimate needs average proof size, batching policy and proof-writing frequency. A Trace estimate needs the share of registered contributions actually retained on Walrus and their average retained file size, including any derivatives. Neither agent activity nor contribution counts supply those missing inputs.

Both estimates also require retention periods, renewal behavior and the identity of the payer, including any pilot subsidies or foundation funding. These inputs should be disclosed before translating announced reach into paid storage demand.

Annualized charge = daily original GB × 365 × 4.564 × $0.023 × 12.

Illustrative annualized storage charge

Four illustrative workloads, logarithmic scale.

1. $100M a year · about 79.4 PB held
2. 1M actions a dayAction records, 10 kB each
   $4.6K
3. 10M actions a dayAction records, 10 kB each
   $46K
4. 100M records a dayRicher records, 30 kB each
   $1.38M
5. 10,000 robotsSensor data, 1 GB each a day
   $4.60M
6. $1K$10K$100K$1M$10M$100M

Dashed line: $100M a year, the charge on about 79.4 PB of original data held continuously. Assumptions: records batched into 1 GB blobs, about 4.564 billable GB each after encoding, at $0.023 per GB per month. An illustrative model, not a customer forecast; excludes upload, gas, retrieval, encryption, indexing and support.

Source: Khala Research model using Walrus pricing and storage-cost documentation.

These calculations exclude upload-related charges, Sui gas, retrieval services, encryption, indexing, support and application margins. Actual encoded size requires a quote for the chosen file layout. Retaining one GB per robot per day is an assumption about selected evidence, not a measurement of robot telemetry or a recommendation to retain everything.

The sensitivity is substantial. Reducing the robot example to 0.1 GB retained daily brings the modeled annual charge to roughly $460,000. Extending retention from one year to three would approximately triple the steady-state retained volume, assuming the same daily additions and unchanged pricing. That longer period would require a renewal process: Walrus’s documentation limits a storage purchase to 53 epochs, roughly two years, and requires extension before expiry. A blob marked permanent remains available through its paid lifetime; the word does not mean perpetual funding.

Market size is best read the same way, as the volume of retained data a revenue figure would require. Under the same batching assumption, ~79.4 PB of original data held continuously would support a $100M annual storage charge. That is a scale requirement derived from the price, rather than an estimate that Walrus will reach it. Larger batches reduce fixed overhead; a different mix of file sizes or prices changes the result.

Application businesses can generate materially more revenue than the storage they consume. A hypothetical evidence service selling 100 enterprise subscriptions at $50,000 a year would produce $5M in annual subscription revenue. Its Walrus spend would depend on retained data, independently of that selling price. Investors should distinguish the market for complete evidence software from the part earned by the underlying storage network.

08Value Accrual

$WAL is used for storage payments, staking and governance. Storage payments are distributed over time to storage nodes and the holders who stake with them, with rewards linked to node performance. This connects demand for storage to the network’s economic activity, but it does not give every passive $WAL holder a contractual claim on application revenue.

On 27 October, Walruscan showed 137 storage nodes using 2,324 TB of the network’s 4,000 TB capacity across about 18M files, with 1.0B $WAL staked, about 38% of the 2.62B in circulation.

The USD pricing model gives customers a more intelligible storage budget. It also means a higher $WAL price can reduce the number of tokens required to pay the same dollar-denominated bill. Gross activity is therefore not a simple multiplier for token demand. Operators have costs to cover and may sell rewards; new supply and incentive distributions can offset demand from users or stakers.

Prepayments require careful interpretation. Cash or tokens received for future storage differ from compensation earned for storage delivered during the period. A fee dashboard should separate customer-funded payments, promotional credits, protocol incentives and any burn mechanism. Deleting or burning a Sui storage object should not be confused with burning $WAL.

We would monitor recurring paid storage, the duration of funded commitments, customer renewals and operator compensation after incentives. Staking participation, supply entering circulation and the distribution of operating costs then help assess the token implications. A valuation based on those variables is more defensible than one based on the notional value of assets mentioned in stored documents.

Applications built on Walrus keep their own economics. SUI pays for Sui transactions, and neither an application’s licensing income nor its usage figures accrue to $WAL holders automatically. What reaches $WAL is funded use of Walrus storage and the network payments it generates.

What reaches $WAL

How storage payments flow, and what sits outside $WAL.

Customer

Buys storage priced in USD, paid in $WAL.

Storage payment

Distributed over time, not paid out at once.

Shared over time

Storage nodes

Rewards linked to performance; costs to cover.

Stakers

Rewards through the nodes they stake with.

Does not reach $WAL automatically

Sui gas

Paid in SUI

App revenue

Licensing and subscriptions

Asset value

Value of goods in stored documents

Offsets to token demand

USD pricing

A higher $WAL price means fewer tokens per bill

Reward sales

Operators may sell to cover costs

New supply

Supply entering circulation and incentive distributions

What to measure: customer-funded storage, commitment length, renewals and operator compensation after incentives.

09Competitive Landscape

Enterprise buyers already have ways to retain records and detect tampering. AWS S3 Object Lock provides write-once-read-many retention controls, including a compliance mode that prevents an object version being overwritten or deleted during its retention period. CloudTrail log validation uses signed digest files and hashes to detect changes or missing log files. Centralized infrastructure can therefore support verifiable records. The checks are cryptographic in both cases; what differs is who must be trusted. CloudTrail digests are signed with AWS’s keys and stored in the customer’s own bucket, so a counterparty relies on AWS and on the account holder for access. Walrus derives each file’s ID from its content and spreads the data across independent storage nodes, with availability certified on Sui, so no single operator can alter the record unnoticed or make it unavailable.

Verifiable Agent Arbiter (VAA) gives the competitive comparison a concrete hybrid design: customer cloud storage and an independent proof layer can serve the same workflow. Walrus can complement existing cloud operations where counterparties want a shared verification reference. The proofs help only while the supporting records can still be retrieved from the customer’s cloud.

Arweave’s stated focus on permanent decentralized storage illustrates that Walrus is competing within an established category of archival infrastructure. Autonomys pitches the same permanence at agents, describing its Auto Agents as permanently archiving each interaction, decision and reasoning process, though its flagship agent is presented as a demonstration. The choice depends partly on whether the buyer wants continuing preservation or a managed retention period. Neither storage model can determine whether a source document accurately describes an offchain event.

Filecoin is also a current programmable competitor. Its Onchain Cloud offers warm storage for frequently read data, Proof of Data Possession checks that providers still hold it, automated payments and retrieval services, integrated through the Synapse SDK. A comparison that treats Filecoin solely as a cold archive would miss that development. Walrus will need to win on the requirements of the workload and the quality of its integration, rather than on the mere availability of programmable storage.

The closest direct competitors record agent activity itself, and most stop short of keeping the evidence. Terminal 3, a Hong Kong data-privacy company, logs each step of an agent’s work to its T3N ledger, a cluster of servers running in trusted hardware, and Singapore’s IMDA cites its payroll agent as a case study in its agentic AI governance framework. The ledger’s consensus tolerates crashed servers rather than dishonest ones, it is not anchored to a public blockchain, and its organization-wide activity log holds metadata only. On Ethereum, ERC-8004 validation records point to evidence held elsewhere, and the standard’s reference contracts do not yet deploy its validation registry. Circle’s Arc chain, launched on 16 September, plans an agent sector for “verifiable agent identity and auditable records”. The academic Agent Flight Recorder design anchors hash-chained agent logs on an Ethereum layer 2, but no event content touches the chain. Each of these still needs an independent home for the underlying records, which makes them as much potential integrations as rivals.

Observability software is often a potential partner. Developers need fast search and an interface for diagnosing failures. They may choose a separate evidence archive for selected records that must survive longer or be disclosed to another organization. Replacing the entire operational toolchain would make adoption harder without necessarily improving the record.

Walrus’s strongest competitive position would come from integrations that produce portable, interpretable evidence with little additional work for the user. Common schemas and independent verifiers can help create that advantage. So can reliable retrieval during an incident, when the archive is most valuable. A proprietary dashboard with a decentralized backend would leave much of the portability argument unfulfilled.

The October announcements could strengthen distribution through the Google Cloud relationship and data-supply integration through Trace. Durability will depend on production use, portable verification and repeat payment. Neither announcement establishes exclusivity or prevents customers from keeping another archive.

We do not see storage alone as a durable monopoly. Applications can retain more than one copy, and large buyers have reasons to preserve alternatives. The more credible objective is to become a preferred archive for workflows where neutrality, programmable management and continuity have measurable value.

Where Walrus has to differentiate

Illustrative positioning across operational integration and shared custody.

Shared custody + independent availability

HighLow

Walrus / Sui workflow

Shared retained files with programmable management

Arweave

Long-term public preservation orientation

Filecoin Onchain Cloud

Programmable storage, verification and retrieval

Agent observability

Strong debugging; export and custody remain

Cloud retention

Strong operations; single-account dependence

Agent audit ledgers

Log agent actions; keep metadata or pointers, not the evidence

LowHigh

Operational integration + live workflow fit

Buyer test: does neutrality reduce real investigation cost? Walrus is most compelling where several parties need a usable record beyond any one organization’s exclusive control.

*Illustrative positioning. Walrus’s far-right placement represents the potential of the proposed Sui and Walrus workflow, assuming that capture integrations, shared evidence formats and review tools are delivered. It is not evidence of greater operational integration today. The diagram is a conceptual comparison, without measured scores. VAA shows how cloud storage and Walrus can serve the same workflow.

10Catalysts & Risk Factors

Catalysts

1. Enterprise VAA adoption: The Walrus team expects Verifiable Agent Arbiter (VAA) to become available to Google Cloud enterprise clients in Q2 2027. Named pilots turning into repeat paid use would show real demand, especially if they disclose the workflow, what the proof covers, who can examine the supporting record and how retention is funded.
   Signal: a named Google Cloud customer running VAA in production and paying for Walrus retention.
2. Agent Trust Plane delivery: The Agent Trust Plane products shown at Basecamp are due in Q4 2026 “in some form”. Moving beyond the demo means published specifications and customer integrations that tie an agent’s permissions to the record of what it did. Interoperability is the other test: integrations with the tools developers already use to route, monitor and assess agents would lower the cost of adoption, and a verifier run by another organization would show the records work outside the platform that created them.
   Signal: a named customer running an Agent Trust Plane integration in production, or an independent verifier.
3. Training data on Walrus: DATA Network and Trace are moving to Sui with Walrus as their default storage, and Perceptron announced on October 22 that it is moving its enterprise data suite to Walrus. Milestones include DATA’s published migration plan, completion of the upgrade, retrievable original files and customer-funded retention.
   Signal: disclosed volumes of original files retained for DATA, Trace or Perceptron, and who pays for them.
4. Independent use of the record: An independent assessor reconstructing disputed tool activity, or a fleet operator investigating an incident, would show the evidence does a useful job. In robotics, a named operator running a narrow production deployment, with evidence captured through a controller or fleet-management integration rather than an uploaded video, would be a meaningful step. A published case should show what was retrieved, which checks were possible and what remained uncertain.
   Signal: a disputed incident reconstructed from a Walrus archive by someone other than the platform operator.
5. High-risk logging deadline: The EU AI Act’s logging rules for high-risk uses apply from December 2, 2027, and preparing for them, along with AI incident disclosures, can bring evidence retention into procurement discussions. A named buyer allocating budget to a system with tested retention and review procedures would turn that pressure into spending.
   Signal: a procurement or audit process that cites the EU AI Act, NIST guidance or the Monetary Authority of Singapore’s SAFR as the reason for independent logging.

Risk Factors

1. Existing systems suffice: Cloud retention controls and signed logs already give enterprises tamper-evident records. If buyers can satisfy their counterparties with those and signed exports, they may see little reason to add a decentralized archive. Walrus needs to show a reduction in dependence, investigation cost or integration effort that is worth paying for.
   Signal: enterprises settling cross-party disputes with their existing cloud logs alone.
2. Bad evidence in: A compromised signing key, manipulated sensor or selective logger can produce convincing false evidence before anything reaches storage. Walrus preserves what it is given, so capture needs independent witnesses and explicit completeness checks, not stronger claims about immutability.
   Signal: a case where an archived record is shown to have been false or incomplete when it was captured.
3. Proofs, not files: Successful applications may consume relatively little paid storage. VAA’s announced Walrus payload is proof material, and compression and batching cut the bill per action further. Training files could support larger workloads, so $WAL’s economics depend on how much source material is actually retained and for how long.
   Signal: average retained bytes per customer, and the share of stored data paid for by customers rather than subsidies.
4. Privacy limits the market: Records may reveal people, commercial strategies or confidential operating data. Encryption controls who can read the bytes but does not settle lawful collection, retention or erasure, so each deployment has to decide what never leaves its own environment.
   Signal: buyers keeping sensitive records in-house and sending only proofs to Walrus.
5. Retrieval dependencies: An application can fail if a service that finds, serves or decrypts the data goes down, or its funding account runs dry, even when the stored data itself is recoverable. The whole retrieval process needs testing, including renewals, key succession, administrator changes and access after a vendor relationship ends.
   Signal: a published end-to-end retrieval test after a vendor change or key rotation.

11Scenario Table

The scenarios below look at how independent evidence for AI systems could develop by 2030, after VAA’s expected availability and the EU AI Act’s high-risk logging deadline. Gartner expects spending on AI governance platforms to reach $492M in 2026 and pass $1B by 2030. Ranges are illustrative, with no assigned probabilities or token price targets.

Walrus earns from the data that is retained, not from this software spend; Section 7 sets out how workloads translate into storage charges. More agents using tools would not, by itself, distinguish the scenarios; retained evidence and paying users would.

12Closing Thesis

In the Hugging Face incident, the investigators’ hardest problem was the record itself: the agents’ message board had been wiped, and recorded tool calls did not always match the commands that ran. That problem grows as businesses delegate work that changes data, moves money or affects physical operations, and an agent’s own account becomes one source among several. The record needs to preserve what the execution systems observed and make subsequent changes detectable.

The machine record addresses that requirement. It combines capture outside the agent’s control with a retained, interpretable archive. In robotics, it connects software instructions to controller and sensor evidence. In software workflows, it connects permissions to actual tool activity. Payments and future onchain asset management extend the same requirement to financial decisions, and training archives extend it back to the data a model learned from.

The October announcements give this thesis a firmer commercial direction: Verifiable Agent Arbiter (VAA) connects it to enterprise evidence workflows, the Agent Trust Plane turns it into a product strategy, and DATA Network and Trace bring training-data provenance into the same stack.

The open question is which records customers will pay to retain independently, at what volumes and for how long. Compact proof archives can support valuable applications with modest storage revenue, and larger source-data archives would change that mix. When an agent and its operator tell different stories, the record nobody can rewrite settles it, and Walrus wants to be where that record lives.

Disclaimer

This report was commissioned by the Walrus Foundation. Khala Research received compensation for its production. All analysis, conclusions, and risk assessments are independently formulated by Khala Research. This report does not constitute investment advice, a solicitation to buy or sell any asset, or a recommendation of any kind. Readers should conduct their own due diligence and consult legal and financial advisers before making any investment decisions.