Cammie Morgan, a sophomore at the Gallagher Academy for Exceptional Young Women, a prestigious boarding school that secretly trains its students to become spies, begins the semester hoping for a fresh start. Nicknamed "the Chameleon" for her talent at blending in, Cammie spent the previous term in a disastrous unauthorized relationship with Josh, a civilian boy from the nearby town of Roseville, Virginia.
On the last day of winter break, Cammie's mother, Rachel Morgan, the school's headmistress, takes Cammie to a covert CIA facility beneath a Washington, D.C., shopping mall for a polygraph debriefing about her relationship with Josh. The examiner asks how she used spy training to develop the relationship and about the memory-modification tea administered to erase Josh's knowledge of those events. Cammie confirms she will not contact Josh again but glances at the polygraph afterward, uncertain whether she was truthful.
Back at the Academy, Cammie reunites with her roommates: Bex (Rebecca Baxter), the first non-American student in the school's history, whose parents are MI6 agents; Liz (Elizabeth Sutton), a genius with a photographic memory; and Macey McHenry, a senator's daughter. The mansion's East Wing has been sealed, supposedly due to chemical contamination. That evening, Cammie and Macey overhear Rachel and Mr. Solomon, Cammie's Covert Operations (CoveOps) instructor, discussing a classified codename the girls have never encountered: "Blackthorne." Rachel insists Cammie "doesn't know anything" and that they cannot reveal the information yet. Cammie quickly determines the East Wing's official cover story is a lie.
The roommates investigate. During a Sunday supper in Rachel's office, Cammie covertly photographs her mother's desk using a camera Liz implanted in her watch. Beneath a drawer, she discovers a hidden photograph of a young Solomon standing with Cammie's father, Matthew Morgan, a CIA operative who disappeared on a mission four years earlier. When Liz enhances the image, they read "Blackthorne Institute for Boys" on Solomon's T-shirt and conclude that Blackthorne is a boys' school, possibly for spies.
Their theory is confirmed during a CoveOps field exercise on the National Mall. Solomon assigns a countersurveillance mission: identify and lose any tails, then reach the ruby slipper exhibit at the Museum of American History by five o'clock. After Cammie and Bex shake a pursuer on the Metro, they split up. A boy strikes up a conversation with Cammie, offering candy and insisting on escorting her to the museum. She dismisses him as a civilian. At the exhibit, Solomon reveals the boy, Zach (Zachary Goode), is a Blackthorne student whose mission was to prevent the Gallagher Girls from reaching the objective. Cammie inadvertently told him her destination and walked him halfway there.
The next morning, Rachel announces that 15 Blackthorne students and their teacher, Dr. Steven Sanders ("Dr. Steve"), will spend the rest of the semester at the Academy. Three Blackthorne sophomores join the girls' classes: Jonas, a quiet research-track student who pairs with Liz; Grant, who gravitates toward Bex; and Zach, who selects Cammie as his guide. Cammie remains wary, caught between annoyance at Zach's cocky demeanor and reluctant attraction.
A CoveOps brush-pass exercise, in which operatives discreetly exchange items while passing one another, takes the class to Roseville. Paired with Zach, Cammie runs into Josh, who is now dating DeeDee, a friend from the previous semester. Zach takes Cammie's hand and introduces himself, creating the impression they are together. The encounter is broadcast through Cammie's comms unit to her classmates and instructors.
A formal masquerade ball doubles as a cumulative exam, requiring students to adopt cover legends, or false identities, while demonstrating mastery of culture, languages, and dance. Cammie dances with Zach until a wardrobe malfunction sends her fleeing to a remote corridor, where Zach finds her. Before anything can happen, Code Black sirens erupt, signaling the mansion's emergency security lockdown. Steel shutters seal the building and classified materials burn. Rachel questions Cammie with genuine fear, but the official story is faulty wiring. The student body suspects Cammie triggered the breach by sneaking out to see Josh, and when classmate Tina Walters asks Zach if he was with Cammie, he denies it, humiliating her publicly. Through a hidden passageway, Cammie eavesdrops on Rachel and Solomon discussing Blackthorne, and she tells her roommates the boys cannot be trusted.
The girls infiltrate the sealed East Wing through a secret passageway. The boys' rooms are unnervingly sterile, with no personal effects or family photos. Liz uploads spyware, Bex plants listening devices, and they place trackers in the boys' shoes. Analysis reveals the boys have no records in any government database, and weeks of monitoring yield nothing useful. Solomon lectures on developing assets, and Macey argues Cammie must cultivate Zach as a source. Cammie fabricates a joint midterm project as pretext, but the study date ends when Zach produces one of her planted bugs and whispers that he is "not all bad" but "not all good, either."
A CoveOps exercise using prototype voice-stress-analyzer rings, which vibrate when someone lies, provides a breakthrough. Partnered with Zach, Cammie asks about his parents. Zach confirms they "used to be" CIA, implying loss. Cammie keeps his secret, recognizing they share the pain of losing a parent. Late one night, Zach challenges Cammie to find out what happened to her father, insisting "somebody knows."
Zach asks Cammie out via a brush-pass note. During the Roseville Founders' Day parade, the roommates run surveillance while Cammie and Zach walk together. On a quiet side street, Zach tells Cammie he is going to kiss her, but DeeDee appears with Josh and shatters the moment. Cammie notices a man in a reversible blue jacket who has appeared three separate times, confirming a tail by the standard countersurveillance rule. She alerts Zach, but he dismisses it. Her truth ring vibrates: Zach is lying.
Cammie regroups with Bex, who confirms others also had tails. The girls sprint back to the mansion and find it in a second Code Black. Mr. Mosckowitz, a faculty member, stumbles toward them, bloodied, gasping that someone stole a disc containing the Gallagher Academy alumni list, the identities of every graduate operative. Using the shoe trackers, the girls detect one solitary signal moving away from the school. Cammie leads her classmates through a secret passageway past the lockdown, and Macey, locked outside during the breach, has commandeered a school van. They follow the signal to an abandoned industrial complex.
Zach and several Blackthorne Boys have followed the girls. Zach explains, with the truth ring confirming his honesty, that he had previously seen the man in the blue jacket with Dr. Steve and assumed it was a routine training operation. They spot Dr. Steve inside the complex with armed guards, a disc in his pocket, and a small plane approaching on a nearby runway. The Gallagher Girls and Blackthorne Boys launch a coordinated assault, and Cammie retrieves the disc after Bex tackles Dr. Steve.
Then Solomon steps out of the plane. Rachel appears beside him, smiling. Mr. Mosckowitz emerges unharmed, his injury staged. The entire operation was an elaborate final exam designed to test whether the two schools could work together under pressure. Solomon announces they have passed and welcomes them to Sublevel Two of the CoveOps curriculum.
Rachel explains that the exchange was prompted by the previous semester's events: The trustees realized the girls needed to learn to trust the men they would someday work alongside. The boys depart for Blackthorne, but in the foyer, Zach dips Cammie and kisses her, saying he always finishes what he starts. He walks to the van without looking back, and Cammie does the same, feeling that the truth, or most of it, has set her free.
In a declassified epilogue set during the summer, Zach tracks Solomon to a remote lakeside cabin, revealing he discovered something troubling. He references intelligence chatter and something called "Boston," urging Solomon that they need to tell someone. Solomon questions what they can prove. The conversation ends unresolved, foreshadowing danger to come.