After learning that the man she has known as Michael Vaughn is under investigation and suspected of being a double agent for another secret terrorist group called Prophet Five, Sydney begins to question whether their business and personal relationship over the years had all been a lie. When she discovers that she's pregnant with Vaughn's baby, she becomes determined to uncover the truth about him. Meanwhile, because of Jack's past betrayal by Irina, he begins to worry that his daughter may suffer the same fate that he did.

Following the theft of a deadly virus, code named Substance 33, in Turkey, Sydney is forced to partner on a mission with new APO agent Thomas Grace where they and Marshall travel to Prauge to look for the stolen virus container where their paths cross with Rachel Gibson, a spy suspected of being involved in activities against the U.S., has something shockingly in common with Sydney that she's working for a black ops group called The Shed, that is run by Gordon Dean and his murderous associate Kelly Peyton. Sydney and Tom must persuade Rachel to infiltrate The Shed to download Dean's computer files to learn where Substance 33 is being hidden. Meanwhile, Dixon must accompany Sloane, who's given a 48-hour pass from prison to acquire a possible cure for his still-comatose daughter, Nadia, from a scientist in Russia.

While Sloane awaits the outcome of his sentencing for treason, a mysterious associate of Gordon Dean approaches him for a favor in exchange for persuading the judges to rule in favor of acquittal. Meanwhile, Sydney and Tom must try to convince Rachel to help them catch the fugitive Gordon Dean who moves his operations to more secure locations. Sydney and Rachel return to the ruins of the Shed's offices in Prague for Rachel to reconstruction Dean's computer server so Tom and Dixon in the Cayman Islands can empty out Dean's bank accounts. Although they are successful, Dean discovers that Rachel is still alive which puts both her and Sydney in grave danger when they are trapped in a car that's hanging by an electromagnet controlled by Dean and his lethal associate Peyton who threaten to drop the hovering car unless Rachel's location is revealed.

Sydney and Tom travel to Marseilles, France when they discover that Renée has stolen the cryo container which contains the cryogenically frozen body of her supposedly dead father. But they soon find themselves under siege in Renée's warehouse hideout by a group of mercenaries who want to reclaim Renée's father when he awakes up from his cryo-induced sleep... so it appears. Meanwhile, Rachel and Dixon travel to San Francisco to assist Marshall in the break-in of a vault facility to copy files to learn more about Renee's father. Elsewhere, Sloane takes matters into his own hands to get himself back into APO and continue his quest to find a cure for Nadia by influencing/blackmailing a influential senator to let him have full access to the CIA's accessories.

After Sydney and the APO team infiltrates a formal party at the Chinese embassy in India to locate a fugitive arms dealer, named Janos Vak, Rachel is chosen to begin very first solo mission by infiltrating an off-shore oil platform, with com-links from Sydney whose pregnancy now limits her role in missions, to steal some computer software from Janos to gain the location of a new weapon. Meanwhile, Sloan, now back at APO, is in frequent contact with the elusive Gordon Dean who wants him to keep close tabs on APO, leading to Dean sending his lethal right-hand assassin, Kelly Peyton, to recover the computer software before APO does leading to a hand-to-hand fight between Peyton and the field-inexperienced Rachel.

Sloane decides to betray Dean when he learns that Nadia's condition will probably not improve. They meet at a race track in Dubai to exchange a network access card which Sydney and Renee stole in Rome, leading to Dean finally being captured. The APO interrogates Dean for information on Prophet Five. Yet another mysterious stranger asks Sloane to eliminate Dean. Meanwhile, Nadia comes out of her coma for a short time after a nameless nurse leaves her room. Under orders from his new Prophet Five contacts, Sloane kills Dean during a routine reboot of the APO's surveillance network, and APO misses its chance to hack the network, but learns Prophet Five is linked to intelligence agencies around the world. At the end, control of Dean's terrorist cell is given to Kelly Peyton.