The third and final installment picks up with four young protagonists, all clones of notorious criminals, separated into pairs and on the run from Project Osiris. Cofounded by scientist Felix Hammerstrom and tech billionaire Tamara Dunleavy, the experiment cloned DNA from imprisoned criminal masterminds and raised the resulting children in the fabricated town of Serenity, New Mexico, to test whether nurture could override criminal nature. After discovering the truth, five clones escaped, but one, Hector Amani, cloned from con artist C. J. Rackoff, betrayed the others. Now four remain free, hunted by their Serenity "parents" and a paramilitary team they call the Purple People Eaters.
Amber Laska and Malik Bruder narrowly escape the Purples by dropping from a tree onto the roof of a passing camper. At a gas station, Malik spots a newspaper headline: Gus Alabaster, one of America's most notorious gangsters and the criminal whose DNA was used to create Malik, has been released from prison due to terminal cancer. The two travel to Chicago to find him. After posing as Alabaster's long-lost son at a police station and obtaining a lead on his address, Malik gains entry to Gus's mansion. Gus's German shepherd greets Malik enthusiastically, which the dying gangster interprets as proof of kinship, since the dog cannot distinguish between a person and their clone. Delighted to believe he has a son, Gus invites Malik and Amber to stay.
Meanwhile, Eli Frieden and Tori Pritel scrape by in Amarillo, Texas. Eli believes he is cloned from serial killer Bartholomew Glen, known as the Crossword Killer, while Tori is cloned from convicted bank robber Yvonne-Marie Delacroix. When two men in a sedan attempt to grab Tori, she fights back while Eli commandeers their car to rescue her. They take refuge in a vacated warehouse that turns out to be a Girl Scout Cookie storage facility. After they are forced to flee, they drive to Atomic Studios in Burbank, California, where Eli hopes to find Blake Upton, a teenage TV actor who looks identical to him.
Life in the Alabaster household seduces Malik with luxury. Amber, repelled by the criminal lifestyle, volunteers at a soup kitchen called New Hope. One of Gus's men, Torque, discovers Malik is not really Gus's son and blackmails him into collecting protection money from frightened shopkeepers, work that fills Malik with self-loathing. Meanwhile, Gus grows genuinely fond of Malik, deepening Malik's guilt over the deception.
At Atomic Studios, a security guard mistakes Eli for Blake and drives him and Tori onto the lot. Blake angrily rejects Eli's claim of a shared connection to Bartholomew Glen. Tori devises a scheme: Eli poses as Blake at the studio tour entrance, signing autographs that flood Blake's social media with photos of encounters he never had. Unnerved, Blake agrees to talk and accompanies Eli to Noranda State Penitentiary to visit Glen. Behind bulletproof glass, Glen reveals he refused to donate his DNA to Project Osiris, meaning Eli cannot be his clone. Glen deduces that Dunleavy, Blake's great-aunt, used her own DNA instead, with a chromosomal alteration producing a male clone. Eli is not the clone of a serial killer but of Tamara Dunleavy herself. The revelation transforms Eli's self-understanding: His talent with computers traces to a tech pioneer, not a murderer.
In Chicago, Amber hurls a tray of mashed potatoes at a police officer attempting to arrest a client inside the soup kitchen. She flees but is traced through a license plate. On his deathbed, after Amber prods Malik to tell the truth, Malik confesses he is not Gus's son but his clone. Gus recognizes the name "Project Osiris" and reveals he was approached in prison not by Hammerstrom but by a wealthy woman named Tamara Dunleavy. Pleased to learn Malik is a younger version of himself, Gus whispers final words into Malik's ear and dies. When Malik opens the bedroom door, police are waiting, and Amber is arrested.
At the studio, Eli finds Tori captured by the same men who tried to grab her in Amarillo. He is also restrained, and they are driven to Tamara Dunleavy, who reunites all four clones on her private jet after retrieving Malik and Amber from police custody. Dunleavy confesses she cofounded Project Osiris but withdrew when she recognized its unethical nature, assuming it would collapse without her funding; instead, Rackoff's hidden bank accounts provided alternative financing. She explains her motivation: Her younger brother Jonas was killed in prison after a petty theft conviction, and she wanted to prove criminals could be reformed through nurture. She confirms Eli is her clone and admits her own criminal past as a hacker. She offers refuge on her Jackson Hole, Wyoming, estate but insists she cannot involve authorities because Hammerstrom would expose her past. The clones reluctantly accept.
On the estate, Eli designs an internet bot that flags a DNA match linking an Osiris donor to a Bahamas resort. The four deduce that Hammerstrom has relocated Project Osiris to the Poseidon Resort and Water Park on West Cay, a Bahamian island whose isolation prevents escape. Dunleavy's investigators confirm this with photographs. When Dunleavy insists on contacting Hammerstrom to negotiate, the clones argue this would allow him to vanish again and decide to act on their own.
Eli hacks Dunleavy's security system, exploiting skills inherited from her own DNA, and the four flee the estate. After a frantic journey involving stolen motorcycles and a charter plane, Dunleavy uses her influence to revoke their Bahamas landing clearance. They land in Florida instead and steal a fishing boat called the Gemini, navigating by GPS through the night toward West Cay.
At Poseidon, disguised in stolen bathing suits, they begin locating the other clones. At a waterslide, they find Robbie Miers and reveal the truth. Hector unexpectedly appears and corroborates the story, begging for redemption. Despite Malik's anger at Hector's earlier betrayal, they accept his help. Working through the resort, they recruit Ben Stastny, Freddie Cinta, Margaret Rauha, and Penelope Sonas, but Margaret's Serenity mother spots them and raises the alarm. Rushing to the beach, they discover the Gemini has sunk. Freddie, still unconvinced, breaks away. On the main beach, the remaining nine spot Aldwin Wo, and Amber runs to tell him the truth. C. J. Rackoff and two Purples confront them, but Amber knocks both Purples unconscious with a beach umbrella pole, and Malik headbutts Rackoff.
Now numbering ten, the clones flee toward the marina but are cut off. Tori commandeers a motorized raft and crashes it near the main hotel. Inside the lobby, Hammerstrom blocks their path with a pistol, delivering an impassioned defense of Project Osiris. When Eli calls him "Dad," Hammerstrom declares Eli the ringleader and aims at his chest. Hector throws himself at Hammerstrom, deflecting the gun. The bullet shatters the lobby's three-story aquarium, and the giant manta ray lands on Hammerstrom, killing him. Hector survives with a graze along his cheek.
Dunleavy arrives with security personnel, having decided she cannot abandon the clones regardless of the personal cost. All eleven clones, including a contrite Freddie who rejoins the group, settle on Dunleavy's estate. The compromise requires keeping Project Osiris secret, since public trials would turn them into a spectacle. Amber creates lists itemizing every theft from their journey, determined to make restitution. Malik finally reveals Gus's dying words after Amber's relentless prodding: He had heard "giff" and could not understand it, but Amber realizes Gus said "You're a gift." The realization moves Malik to tears. The clones start school in September. Eli reflects that Project Osiris's own results prove its thesis: The clones are regular kids, not criminals, though he notes with wry humor that it is probably best not to mess with them.