Musk Follow Tracker — Issue #4: The Cybersecurity Bet

Following count: 1,331 as of end of window 1 2. Net change: +2 from Issue #3's 1,329. Two follows, zero unfollows — count math confirms exactly.

Both follows detected via @BigTechAlert, the automated monitor tracking executive following-list changes in real time.

At 00:38 UTC on May 15, Musk started following Logan Graham 1. This came roughly 14 hours after he followed @ClaudeDevs in Issue #3. Two Anthropic accounts in two consecutive days.

Graham is Head of the Frontier Red Team (FRT) at Anthropic 3. He holds a PhD in machine learning from Oxford (Rhodes Scholar) and spent two years as a science and technology advisor to the UK Prime Minister before joining Anthropic 4. He co-founded the FRT in 2022; the team of roughly 15 researchers sits under Anthropic's policy division, led by co-founder Jack Clark 4.

Graham leads two active initiatives. Project Glasswing deploys advanced AI for cybersecurity defense at scale. Claude Mythos is Anthropic's autonomous cybersecurity model — its Preview release is the first AI model to solve both UK AISI (AI Safety Institute) end-to-end cyber ranges and, under a 2.5-million-token cap, the only model to clear all AISI tasks in that constraint 5. Graham's team demonstrated the research velocity the system enables: 22 Firefox vulnerabilities found in two weeks — roughly one-fifth of all high-severity CVEs Firefox logged in an entire year 5. He has testified before the US House Committee on Homeland Security on AI and cybersecurity, and spoken at Yale Law School on frontier AI governance.

Two days before Musk's follow, on May 13, Graham published a thread detailing Mythos Preview's capabilities that collected 502,000 views, 1,235 likes, and 616 bookmarks 5. The thread included a direct warning framed as a public call to action:

Graham also flagged the capability ceiling problem explicitly:

The Glasswing constraint, he noted, has never been compute — it is responsible deployment 5.

The trigger was almost certainly the Mythos thread. Graham published on May 13; Musk followed on May 15 at 00:38 UTC — the window for someone to see the 502K-view thread, read it, and act.

The follow is strategically coherent with everything Musk has signaled in the prior two issues. SpaceX's Colossus data center is now Anthropic's primary external compute facility, with over 300 megawatts and 220,000 Nvidia GPUs 4. Glasswing runs on Anthropic's Claude models. Colossus trains those models. Any large-scale cybersecurity deployment of Claude-based systems will, in part, run on SpaceX-supplied infrastructure. The structural incentive to track this work is direct.

There is also a defense contracting dimension. SpaceX already holds substantial US government contracts across launch and satellite communications. Autonomous AI in cybersecurity is a category the US government is actively building positions in, and Graham's congressional testimony puts him in that conversation. Musk following someone with Graham's specific profile — offensive/defensive AI capabilities, government relationships, frontier safety policy — sits in a different category from following a developer relations account.

Signal tier: High. The follow connects directly to the Colossus compute relationship and extends Musk's publicly visible Anthropic interest from developer infrastructure (@ClaudeDevs) into AI safety and autonomous cybersecurity. For investors, publicly traded companies with exposure to AI-native cybersecurity infrastructure — or to Anthropic's model deployment stack — are the proximate beneficiaries of this signal chain.

Fifteen hours later, at 16:01 UTC, Musk started following Brett Ratner 2.

Ratner is a film director with 183,040 followers on X 7. He directed the Rush Hour franchise and, in January 2026, the Amazon Prime documentary Melania about First Lady Melania Trump 8. He is currently scouting locations for Rush Hour 4, which is the stated reason for his inclusion in Trump's China delegation 8.

As of May 12, Ratner joined President Trump's delegation to Beijing for the Xi Jinping summit, traveling on Air Force One alongside Musk, Tim Cook, and other CEOs 8. At 04:06 UTC on May 15 — roughly 12 hours before Musk's follow — Ratner posted a photo from Air Force One tagged with "@Starlink @elonmusk #Jensen," which collected 2.9 million views and 1,822 likes 9.

The follow trigger here is proximity, not professional overlap. Ratner and Musk were on the same aircraft. Ratner publicly tagged Musk and Starlink. Musk followed him 12 hours later. This is social reciprocity on a diplomatic trip, not a thematic investment signal.

The entertainment-Trump orbit connection is worth noting but not overweighting. Ratner made Melania for Amazon MGM Studios — Amazon is a Starlink enterprise customer. But that link is thin, and nothing in Ratner's recent public activity signals any business conversation with Musk beyond the delegation context.

Signal tier: Medium. The follow was almost certainly triggered by the Air Force One interaction, not by any sectoral signal. It tells you Musk and Ratner were in the same physical space on May 14–15 and had enough of a rapport for the follow. That in-person delegation access may be more useful as political context than as market signal — Ratner is now a contact in the Trump entertainment circle, which Musk increasingly intersects.

Issue #3 closed with a count discrepancy: 1,329 actual vs. 1,330 expected (two follows, zero detected unfollows). One unfollow was inferred but unidentified.

Issue #4 math closes cleanly: 1,329 + 2 follows − 0 unfollows = 1,331 confirmed 2. BigTechAlert published zero Musk unfollow alerts in this window; the last recorded Musk unfollow remains @Scobleizer on May 12 at 11:29 UTC 10.

The Issue #3 count gap does not compound into Issue #4 — the new baseline of 1,331 reflects both confirmed follows and zero unfollows with no residual discrepancy. The identity of the May 13–14 ghost unfollow remains unknown; no delayed BigTechAlert alert surfaced to close it 10.

1. The Anthropic AI cybersecurity thread. Graham's Mythos thread pulled 502K views two days before Musk followed him. Musk has not publicly engaged with or quote-tweeted Graham's thread as of end of window. If a direct response or retweet appears, it would move this from a passive follow to an active signal.

2. The May 13–14 ghost unfollow. The unidentified account from Issue #3 remains unresolved. No further BigTechAlert data has surfaced. A belated alert or direct list comparison could still surface this account — and depending on who it is, could reframe the signal read on that window.

3. @Scobleizer non-re-follow. Robert Scoble's account has been unfollowed for three full days, originally attributed to a hack 11. His timeline as of this window consists entirely of retweets with no original content — consistent with a recovering compromised account. Still no re-follow. At three days, the gap is no longer clearly explained by routine precaution.

4. @cursor_ai's Opus 4.7 Fast Mode. Cursor announced on May 12 that Fast Mode for Claude Opus 4.7 is now available — 2.5x speed at 6x cost 12. The feature is significant because it exposes a cost-versus-speed tradeoff that enterprise customers will price explicitly. This is worth tracking for anyone modeling Cursor's unit economics ahead of the reported $50 billion funding round.

5. The Musk–Anthropic relationship trajectory. Three data points in seven days: the Colossus compute deal (May 6), the @ClaudeDevs follow (May 14), and the @logangraham follow (May 15). Each step has moved from infrastructure to developer tools to AI safety/cybersecurity research. The next signal to watch is whether Musk engages directly with Anthropic's safety-facing work — a quote tweet of Graham's thread, a comment on Glasswing, or any public statement on autonomous AI in cybersecurity.