Sarah Fittler, Julia Ormond and her nine-year-old son take a taxi home from the cinema, but the driver Bob, Vincent D'Onofrio, abducts them and drives them to his house. As a result of the abuse his father inflicted on him and his brother during childhood—an abuse that even twisted Bob into sexual misconduct with his own mother—Bob has become a serial killer who rapes and murders young women. He kills Sarah and imprisons her son, whom he names Rabbit. When Rabbit tries to escape, Bob chains him to a wall.
Nine years pass, and the teenage Rabbit remains in Bob's house, doing housework, burying the bodies of Bob's victims, and scrapbooking newspaper clippings about them at Bob's request. Even as he is kept captive, Bob tries to position himself as a paternal figure, having Rabbit learn about human anatomy and perform chores around the home. To reinforce his control, Bob reveals that Rabbit's father Brad, Jake Weber, has since remarried. He also releases Rabbit from his chains. In trying to bring Rabbit closer, Bob aims to shape him into a killer like himself.
To complete Rabbit's transformation, Bob asks him to pick a victim from a yearbook. Rabbit initially refuses, but under pressure he selects a girl named Angie, Conor Leslie who plays Angie, and Bob abducts her. Leaving Rabbit and Angie alone together, Bob warns Rabbit that he will kill Angie if Rabbit does not comply. Rabbit hesitates but begins to bond with Angie, though he stabs her in the stomach when Bob barges in. He then drags her body into the room that holds the corpses of Bob's earlier victims. Satisfied, Bob agrees to let Rabbit hunt for another girl.
Bob takes Rabbit into the city in his cab and suggests several potential victims, but Rabbit refuses them all. During the drive, Bob notices that Rabbit has written the word “help” on the side of the cab. He realizes that Rabbit stabbed Angie in a non-lethal spot, using his anatomy knowledge. He knocks Rabbit unconscious and goes to the room where Angie is hiding to finish her off. Angie manages to cut Bob's Achilles tendon, and Rabbit wakes up just in time to save her. In the ensuing struggle, Rabbit kills Bob and buries him beside his victims.
With Bob gone, Rabbit—whose real name is Tim—tracks down Brad, who is now living with his new wife Marie and Rabbit's half-brother Colin. Brad pretends to be glad he survived, but Tim confronts him with the truth: Brad had arranged the abduction of him and his mother. Tim finds a letter confirming that Bob is Brad's brother and his paternal uncle. Brad had urged Sarah to take a taxi on the day of the kidnapping, hoping to rid himself of his first wife and son. Brad reacts with violence toward Tim and Marie when she tries to intervene, and Tim ends up killing Brad. After Tim leaves, Marie calls the police and says that a burglar killed her husband.
Tim returns to Bob's house and shuts the garage door. As the credits roll, the sounds of him moving through the house—the fridge, the cutting of paper, the garage door, and the cab—echo in the silence, leaving a haunting sense of what has happened and what might still come.
