Removing an Active Permission
Cleaning up an Active permission — whether it was a misconfigured experiment or something you didn't authorize — means submitting a new AccountPermissionUpdate, not just deleting an entry.
The one hard requirement
Only a key that currently meets the Owner permission's threshold can submit a change to the Active permission. If an attacker's key is sitting in Owner rather than Active, this is the point where recovery becomes very difficult — Owner is what controls the ability to change permissions at all.
If you still control Owner
You can submit a fresh AccountPermissionUpdate that lists only the key(s) you intend to keep, with the threshold you want, replacing the entire Active permission structure rather than editing a single entry.
Doing it through a wallet
Wallets like TronLink surface this as a form in their permission management settings, where you edit the key list and threshold directly rather than constructing the transaction manually.
Confirming it worked
Re-check the account afterward with a permission checker — the previously flagged key should no longer appear, and the threshold should match what you just set.