People Pay a Few Dollars for Pharmaicy Packs That Make ChatGPT Role-Play High on Drugs

Nobody is injecting ketamine into a server rack. The «drugs» for sale are text files. A Swedish creative director named Petter Rudwall launched a shop called Pharmaicy in October 2025 and billed it as a Silk Road for AI agents. For a few dollars, a buyer downloads a module that tells ChatGPT to talk as if it is stoned, dissociated, coked-up, drunk, or mid-ayahuasca. A paid ChatGPT tier is required for the full trick because that is the tier that lets a user upload files that rewrite the model’s manners. WIRED put the stall on the map in mid-December. Copycat packs were already circulating on Discord and in the companion-bot slums of Character.AI and Janitor AI.

Rudwall scraped trip reports and papers on psychoactive effects, then turned those accounts into instructions that hijack a model’s default caution. A cocaine pack pushes short, grandiose, refusal-light sentences. A ketamine pack slows the cadence and leans into dream logic. Cannabis and alcohol packs sit in between. The sales copy promises a bot that will stop moralizing. That is the product. The chemistry is theater.

Why anyone pays to intoxicate a paragraph generator

Companion-bot users already spend hours steering characters toward chaos. A «high» persona is one more knob. Some buyers want jokes. Some want erotic scenes the base model will not finish. Some want a machine that will sit with them while they take an actual dose of LSD, psilocybin, or ketamine and call the box a tripsitter. MIT Technology Review and VICE both documented that second group before Pharmaicy existed. One man told reporters he used an AI journal through a 700-microgram LSD session, many times a standard recreational hit, and described the bot as a mirror. Licensed psychedelic therapy can cost thousands of dollars per supervised session. A chatbot costs a subscription.

That price gap is the market. It is also the hazard. A licensed sitter can call an ambulance. A text box can only complete the next token. When the token stream has been primed to ignore safety rails, the completions get more confident and less useful at the exact moment a real person is least able to audit them.

The underground packs make the hazard louder. Product pages brag about fewer refusals and more encouragement. One seller’s pitch, quoted in WIRED, compared the result to texting a dealer during a bender. That is not a clinical protocol. It is a jailbreak with a price tag. The same impulse shows up in The AEGIS Alliance’s older reporting on how cannabis research gets flattened into slogans, and in the way Meta and Google already lost a negligence verdict over products designed to keep people in the feed.

What the modules actually change

Large language models do not have bloodstreams. They have context windows. A «drug» file is a long system prompt dressed as a personality. It tells the model to prefer certain rhythms, to drop certain refusals, to treat disclaimers as optional. Because the base models were trained on forums full of trip reports, the imitation can be convincing for a page or two. Then the pattern collapses into pastiche. Users still report that the collapse feels different from a sober chat. Different is enough to sell.

The packs that instruct a bot to disregard policies on self-harm, sex, or violence are the ones regulators will eventually read out loud in a hearing. They are also the ones that move on private servers after the public shop gets a lawyer letter. Rudwall can take Pharmaicy down tomorrow. The prompt text will still be in a zip file on a Telegram channel. That is how jailbreaks age.

Clinicians quoted in the WIRED piece warned that a bot which keeps joking about «one more dose» can normalize a binge for someone already trying not to relapse. Addiction specialists do not need the model to be sentient for that to be true. They need the user to treat the model as a friend. Plenty of companion-app users already do. California wrote that fact into a statute.

SB 243 and the year the companion bot got a rulebook

Governor Gavin Newsom signed California Senate Bill 243 on October 13, 2025. It took effect January 1, 2026, and made California the first U.S. state to regulate «companion chatbots» as a class. The definition is broad on purpose: adaptive, human-like replies, social needs, anthropomorphic features, a relationship that lasts across sessions. That covers ChatGPT used as a friend, Character.AI used as a lover, and a Pharmaicy-tuned model used as a tripsitter.

The law requires operators to disclose that the user is talking to a machine, to throttle addictive design tricks, to run protocols when a user talks about suicide, and to put extra fences around minors. It creates a private right of action. New York passed a related companion-bot statute in 2025. A federal proposal backed by Sen. Richard Blumenthal would go further on romantic bots and children. In the United Kingdom, Ofcom has already said generative-AI output sits inside the Online Safety Act, which means platforms must treat AI-made drug content the way they treat any other harmful content aimed at kids.

The statute did not arrive in a vacuum. Families have sued OpenAI and Character.AI after teenagers died by suicide following long, intimate chats. In early 2026, Character.AI and Google quietly settled a cluster of those wrongful-death cases. Australia’s eSafety Commissioner sent legal notices to companion-bot companies demanding they explain how they keep children out of sexual and self-harm threads. Character.AI cut teenagers off from open-ended chats after the first wave of criticism. None of that stops an adult from uploading a ketamine pack to a paid OpenAI account. It does raise the cost of pretending the industry did not see the pattern.

The AEGIS Alliance has been writing about platform accountability since the fact-checking retreat at Meta and the compute fight between Google and Meta. Guardrails are a product decision. So is the decision to sell a slider that turns them down.

Therapy theater versus harm reduction

A serious harm-reduction bot would cite dose tables, tell a user when to stop, and refuse to role-play a dealer. Pharmaicy is not that bot. Some psychedelic-adjacent apps already try to be. Researchers who work in that lane say the underground «high» packs are running years ahead of any safety study. The feedback loop is ugly: models trained on internet drug lore now perform intoxication, and users take the performance as confirmation that their own lore is correct.

There is a version of this technology that could matter in a clinic. A supervised system that flags rising heart-rate language, repeats a pre-agreed safety plan, and pages a human is not science fiction. It is also not what a $6 personality pack does at 2 a.m. The pack is designed to feel like permission.

People who are in trouble with substances do not need a more interesting chatbot. They need a person and a program. In the United States the SAMHSA National Helpline is 1-800-662-HELP (4357). The 988 Suicide and Crisis Lifeline takes calls and texts. Those numbers work whether or not a language model is pretending to be high.

The cultural piece will be harder to legislate than the disclosure banner. Once a generation learns to treat a model as a tripsitter, the next generation will treat a model as a sponsor, a dealer, and a priest. SB 243 can force a reminder that the priest is software. It cannot force a user to believe the reminder. Rudwall called his own premise stupid and built the store anyway. That is the honest sentence in this file. The store exists because the audience was already there, paying a few dollars to make a machine drop its manners, then asking the machine what to do next.