The story follows 12-year-old Teddy Fitzroy, who lives with his parents at FunJungle, the world's largest zoo, in the Texas Hill Country. His mother is a primatologist and his father a wildlife photographer, both employed by the park. Teddy, who grew up in the Congo, is an outsider at his local middle school, where 15-year-old Vance Jessup has bullied him since his first day of seventh grade.
The trouble starts when Vance overhears Teddy joking with his best friend, Xavier Gonzalez, about dropping a fake human arm into the shark tank to panic tourists. Under threat of violence, Vance forces Teddy to execute the prank. Teddy smuggles mannequin parts through the employee entrance and drops them into the Shark Odyssey exhibit, sparking mass hysteria. Large Marge O'Malley, the head of park security and Teddy's longtime antagonist, chases him through the exhibit.
Fleeing, Teddy ducks into the exhibit housing Kazoo, a koala on a six-month loan from Australia. Billionaire park owner J.J. McCracken obtained the koala to boost winter attendance and built an entire section called KoalaVille around it. Teddy enters using a secret security code that J.J.'s 13-year-old daughter, Summer McCracken, shared with him during a previous investigation. He hides in the warm habitat. Kristi Sullivan, Kazoo's head keeper, does a brief evening check without noticing Teddy, who falls asleep and slips out after dark.
The next morning, Summer calls to warn that Kazoo has been stolen overnight. Security footage shows only Teddy entering and leaving the exhibit with a backpack large enough to hold a koala, making him the prime suspect. He escapes into the woods moments before Marge and Officer Bubba Stackhouse from juvenile services arrive to arrest him. Summer urges Teddy to investigate on his own, arguing that Marge will never look for another suspect.
Teddy's parents suspect he has been deliberately framed. To avoid Marge, Teddy enters the park disguised among schoolchildren while Dad reviews security footage at Carnivore Control, the park's carnivore-monitoring office. A keeper named Arthur Koenig secretly alerts Marge, who corners them, but Dad handcuffs Marge and Bubba together with Marge's own cuffs and escapes with Teddy. The chase leads to KoalaVille, where Teddy learns the kidnapper covered their tracks by placing a stuffed toy koala in the tree where Kazoo normally slept. Pete Thwacker, FunJungle's head of public relations, has kept the fake on display rather than reveal the theft. When Marge crashes through the glass viewing wall and flattens the stuffed animal, tourists discover the deception and turn furious.
Tracey Boyd, the park's manager of operations, excoriates Pete and Marge. In a subsequent conversation, Kristi tells Teddy that the exhibit's interior cameras were never connected to the main system and do not record, explaining why no footage of the thief exists. She names potential suspects, most notably Freddie Malloy, a bitter former animal-show host who has threatened Kazoo. Tracey then fits Teddy with a GPS ankle bracelet and warns that any further interference will cost both his parents their jobs.
That evening, Summer persuades Teddy to keep investigating, arguing that solving the case is the only way to protect his family. She suggests he disguise himself in a Kazoo mascot costume. At school the next day, Vance and his cronies, identical twins Tim and Jim Barksdale, corner Teddy, but popular eighth-grade football players intervene. At lunch with the popular kids for the first time, Violet Grace, the head cheerleader, shows Teddy a viral video of the KoalaVille disaster. In the background, Teddy notices a thickset man in an orange Houston Astros baseball cap and indoor sunglasses, watching with an oddly calm expression.
After school, Teddy dons the mascot costume and investigates. Near the park's carnivore exhibits, he overhears Arthur Koenig on a suspicious call demanding more money for something obtained at personal risk. In the deserted KoalaVille, he spots the man in the Astros cap meeting with Freddie Malloy, then follows the man to the Shark Odyssey employee area. When the man catches Teddy and attacks him, tourists intervene. Teddy memorizes the man's license plate and passes it to Summer for J.J.'s security team.
J.J. reveals that the plate traces to Hank Duntz, known as "Hank the Tank," an enforcer for J.J.'s bitter rival, billionaire Walter Ogilvy, who has spent years trying to sabotage FunJungle after failing to build his own competing park. J.J. tells Teddy to leave the rest to professionals, but as the family exits, Marge ambushes them with police, announcing she found koala fur and droppings in Teddy's bedroom. Dad is arrested for punching an officer while protecting Teddy. Spotting Hank heading toward Shark Odyssey, Teddy breaks free and runs after him.
Inside Shark Odyssey, steel doors slam shut, trapping Teddy, Marge, and Bubba in the glass viewing tube. Plastic explosive on the ceiling detonates, shattering the glass and flooding the tube. Swimming upward, Teddy is rammed by the exhibit's bull shark and punches it in the nose to drive it away. Mom dives in and pulls him to safety as he begins to lose consciousness. Hank is caught fleeing.
To extract a confession, Teddy exploits a discovery Mom recently made: A chimpanzee named Furious George erupts in violent rages at the sight of orange baseball caps, likely because someone wearing one previously abused him. Mom tells Hank that George is a "living lie detector." When Hank is placed near the chimp, George sees the cap and erupts in fury. Terrified, Hank confesses to sabotaging the shark tube on Ogilvy's orders, with Freddie providing security codes, but insists he did not steal Kazoo, explaining that someone took the koala before he and Freddie could act. J.J. believes Hank's denial and allows Marge to arrest Teddy once again.
As Marge leads Teddy to a police car, Kristi runs after them, pleading for someone to find Kazoo. A detail clicks: Kristi had described Kazoo as "easy to handle," revealing she never performed her duties diligently. Teddy realizes Kazoo was stolen not the night he hid in the exhibit, but the night before. The kidnapper replaced the koala with a stuffed toy, and the inattentive Kristi never noticed. Security reviewed footage from the wrong night. Bubba agrees to check earlier recordings, and the video confirms the theory: Kristi leaves without locking the door, and a hooded figure enters, swaps the toy for the real koala, and disappears.
Teddy identifies the thief as Vance Jessup. Bandages on Vance's hands conceal koala bite marks, and the anonymous tip about Teddy's room came after Vance saw Violet give Teddy her phone number, meaning Vance planted the evidence out of jealous rage. At school, Violet confirms the story: Vance stole Kazoo on impulse to impress her, having had a crush on her since third grade. He seized the opportunity when Kristi left the door unlocked, but when the koala proved aggressive, he hid it and threatened Violet into silence. When Vance's cronies try to slip away, the football players tackle them, and one blurts out that Vance is hiding Kazoo at his uncle's closed-down garage.
At the garage, Vance bursts from a shed with the screeching koala in his backpack and charges at Teddy. Teddy punches Vance in the chin, knocking him unconscious. Mom extracts a severely weakened Kazoo, and they rush to FunJungle's animal hospital.
In the aftermath, the veterinary team nurses Kazoo back to health, but the Australian government revokes FunJungle's contract and retrieves the koala, still charging J.J. the 5 million dollars he donated for conservation. KoalaVille is demolished. Hank and Freddie face criminal charges, and J.J. sues Ogilvy. Marge is demoted, Kristi is transferred to public relations, and Vance receives 12 months in juvenile detention. Teddy's social standing at school transforms: He befriends the popular kids, Xavier joins the new circle, and the bullying stops. Summer surprises Teddy by arriving at FunJungle, telling him she may transfer to the local school. Teddy, his heart racing, tells her that would be "awesome."