Bharat Suneja

AI-native builder. Windows. Security-first. Formerly Microsoft Exchange/M365. Building in public. |

[Bharat Suneja @bsuneja]

Built a Windows process monitoring agent this morning. First real-world run surfaced a textbook degradation pattern on a mission-critical app:
🔴 Sustained memory leak — private bytes growing unbounded across sessions
🔴 CPU thrashing correlated with memory pressure (burst spikes to 371%) 🔴 Zombie process — paged out, idle, but holding 3.6GB of committed private memory the OS can never reclaim

The interesting part: the failure signature is consistent and predictable well before the process becomes unresponsive. Working set oscillates while private bytes climb monotonically — classic unmanaged heap leak, GC fighting a losing battle against its own allocations.
Building this into a production-grade Windows monitoring agent — event log correlation, ETW telemetry, process health profiling, and an LLM layer that turns raw signals into plain-English diagnosis and actionable remediation steps. Targeted at power users on critical systems who can't afford unplanned downtime.
Early access interest? Questions? DM @bsuneja. Will share when it takes shape.

[Bharat Suneja @bsuneja]

Proton Mail's "Don't Sign In With Google" post got 14M views.

The advice was right. The explanation was incomplete.

There are actually two separate problems and conflating them makes the conversation harder.

https://t.co/9KeuJrhogb

[Bharat Suneja @bsuneja]

Two separate problems worth distinguishing.

The blast radius issue applies to any federated identity. Google, Microsoft, Okta. One compromised account and everything authenticated with it is in scope. That's an opsec problem regardless of provider.

The tracking problem is Google-specific. Every Sign in with Google feeds behavioral data into a system built to monetize it. Microsoft and Okta aren't in the advertising business.

Both are reasons to be deliberate about which identity providers you trust.

[Proton Mail @ProtonMail]

DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE

[Bharat Suneja @bsuneja]

https://t.co/YVdfz7oqt7 keeps junking @Anthropic's login emails (SCL=5) even when SPF/DKIM/DMARC all pass. Not a user-learning issue. It's Microsoft's bulk-sender heuristics misclassifying SendGrid magic-link traffic.

With the @Microsoft partnership now official, is there a deliverability contact worth looping in? Login emails shouldn't live in spam. [screenshot] @Outlook @MicrosoftHelps

[Bharat Suneja @bsuneja]

Partial win. No concrete roadmap, but Anthropic said they're aware and working on it.

What gives me more confidence is what Microsoft brings: identity, governance, and Microsoft Foundry. Anthropic models with Microsoft's enterprise tooling on Azure. More API/developer than Claude Desktop or Code directly. But partnership changes the conversation.

[Bharat Suneja @bsuneja]

At the @Microsoft + @AnthropicAI AI Startups event last night I asked: why are Claude Desktop and Claude Code still second-class citizens on Windows?

Plenty of nods. Windows is the world's most-used OS. With Microsoft in the mix now, this is the moment to fix it.

[Bharat Suneja @bsuneja]

@paulrobichaux Thank you Sir Clive Sinclair for the Sinclair Spectrum.

[Bharat Suneja @bsuneja]

Dear @Windows team,

Love this. File size units in Details view is a quality-of-life win that's been a long time coming.

If the team ever gets to the blue spinning wheel, shell extension isolation, and the latency/crash chain that comes with them, you'll have Windows users and IT pros writing fan mail.

Wrote about the broader Explorer reliability story last week: https://t.co/IIyjQN484Q

[Bharat Suneja @bsuneja]

The limits hit hardest on exactly the tasks where Claude is most useful. Document processing, long context, multi-step reasoning, architecture. That’s when you want it most and hit the wall fastest.

Pro is priced for casual use. The work you’re describing is Team or API territory.

[Bharat Suneja @bsuneja]

It’s a sunny Saturday and I just hit the @claudeai Max session limit. Right in the middle of a race to ship.

The puzzle: @AnthropicAI just announced they doubled limits and scrapped peak-hour throttling (thanks to that 220k GPU SpaceX deal).

If the ceiling is 2x higher and peak-hour is dead, how are we still hitting the wall?

AI workflows officially scaling faster than AI infrastructure.

#ClaudeAI #LLMOps #BuildInPublic

[Bharat Suneja @bsuneja]

@claudeai @SpaceX Good news for Windows devs building with Grille, a Windows-native MCP server currently in beta. More compute = fewer interruptions mid-workflow. Keep pushing.

[Bharat Suneja @bsuneja]

Windows Explorer has been quietly unreliable for years.

Microsoft is finally admitting it.

Shell extensions, third-party DLL injection, 30 years of extensibility decisions. All of it runs inside the same process as your desktop.

Here's what goes wrong and how to fix it today:
https://t.co/DYsgWbzUh3

[Bharat Suneja @bsuneja]

Claude Desktop and Claude Code are two different apps.

Windows Task Manager can tell them apart — it uses higher-level APIs to surface friendly names.

PowerShell, WMI, Process Monitor, crash dumps, and most monitoring tools cannot. They see kernel-level process names. Both show up as "claude".

Ambiguous process names. Ambiguous logs. Ambiguous crash dumps. Ambiguous PowerShell output.

Slack uses Slack.exe + SlackHelper.exe. VS Code uses Code.exe + CodeHelper.exe. Teams uses Teams.exe + TeamsWebView.exe.

Naming your executables clearly shouldn't require Windows to compensate.

Small things like this tell you where a platform thinks its users live.

Hoping the recently announced @Microsoft + @AnthropicAI partnership changes that. @claudeai

[Bharat Suneja @bsuneja]

@dharmesh The Turing test but backwards. AI proves you're human while you fail to prove it yourself.

[Bharat Suneja @bsuneja]

Security at the code layer. Scanning for vulnerabilities, validating findings, suggesting patches. Exactly the kind of security-first thinking the AI tooling ecosystem needs more of.

I've been building security at the OS layer for Claude on Windows.

The full picture: secure what Claude can touch on your machine, and secure what Claude writes for your codebase. Two different problems, both matter.

#ClaudeSecurity #AIAgents

[Claude @claudeai]

Claude Security is now in public beta for Claude Enterprise customers.

Claude scans your codebase for vulnerabilities, validates each finding to cut false positives, and suggests patches you can review and approve.

[Bharat Suneja @bsuneja]

Malwarebytes confirmed Claude Desktop silently installs browser bridges on macOS. They said they were "in the dark about behavior on Windows."

I checked my Windows machine.

Chrome. Edge. Brave. All three have com.anthropic.claude_browser_extension registered in NativeMessagingHosts — pointing to a manifest in AppData\Roaming\Claude.

Same behavior. Different mechanism (registry vs filesystem). Same result.

PowerShell commands to check your own machine + full write-up:
https://t.co/gDJqabrocS

[Bharat Suneja @bsuneja]

This isn't an AI story. It's a permissions story.

Overscoped token. No confirmation on destructive ops. Backups on the same volume. Agent filled the vacuum humans left.

The guardrails were in the marketing copy.

[JER @lifeof_jer]

https://t.co/ofucbVgkLV

[Bharat Suneja @bsuneja]

Before Stripe lets you receive money, they want access to: every transaction you've ever made, your full account & routing numbers, PDF bank statements, and tax forms.

Buried at the bottom: a manual entry option.
This is normalized. It shouldn't be. 🔒
#Privacy

[Bharat Suneja @bsuneja]

I did not wake up on Friday thinking we were doing this.

From idea to live in 35 minutes.

Registered the domain at 10:14 AM.
Site live on production with Cloudflare proxy and SSL at 10:47 AM.

Most of the heavy lifting: Claude. Design, HTML, Nginx config, SSL setup, deployment via a custom MCP server I built this week.

https://t.co/1mRGaBRkEF has a sibling.

This is what building with AI looks like in 2026.

https://t.co/Abrrd5BbyL 👀
@AnthropicAI

[Bharat Suneja @bsuneja]

@qutyquteshweta @AnthropicAI Needed this yesterday. Ironically just posted about the Windows MCP gap. Watching now.

[Bharat Suneja @bsuneja]

Opus 4.7 moves at the speed of light while Windows users are stuck translating PowerShell into something it'll understand. No reliable filesystem MCP makes it worse. WSL2 isn't a workaround anymore. It's the escape hatch. @AnthropicAI, Windows deserves better.