Mrs Danvers Still Has the Keys

Authority outlives its principal unless something ends it. The orders were never revoked, the successor cannot see them, and revocation turns out to be much harder than issuance.

October 22, 2026 · 11 min read · Jayesh Bapu Ahire

"Last night I dreamed I went to Manderley again." That is the first sentence of Daphne du Maurier's Rebecca, published by Gollancz on 5 August 1938, and the house in the dream is still being run by someone who is dead.

The narrator never gets a name. She is the second Mrs de Winter, and she arrives at Manderley knowing nothing about how it works. On her first morning, Frith the butler tells her the fire in the library is not usually lit until the afternoon. "Mrs. de Winter always used the morning room," he says. She has never seen the morning room; Maxim did not show it to her the night before. She opens the wrong door and Frith redirects her, through the drawing room, on the right, this side of the staircase. Mrs de Winter, he adds, always did all her correspondence and telephoning in there, after breakfast. On the writing desk the pigeonholes are docketed, "letters unanswered," "letters-to-keep," "household," "estate," "menus," "miscellaneous," "addresses," each ticket written in that same scrawling pointed hand that she already knows.

Then the house telephone rings. She tells the voice it has made a mistake, that Mrs de Winter has been dead for over a year. The voice is Mrs Danvers, the housekeeper, asking whether she approves of the menus for the day. The menu is on the blotter beside her, already written, with a blank left beside the sauce for the roast veal, because Mrs de Winter was most particular about her sauces and Mrs Danvers always had to refer to her. The new mistress says they had better have whatever Mrs de Winter would have ordered. A wine sauce, Mrs Danvers thinks. We will have the same then, of course.

Later she borrows a mackintosh from the garden room, big and overlong, the sleeves below her wrist, and finds a handkerchief in the pocket with a tall sloping R and the letters de W interlaced. Later still, Mrs Danvers walks her through the west-wing bedroom that was Rebecca's, where the golden coverlet is kept on the bed always, the brushes are laid out unwashed and untouched, and the nightdress case is monogrammed R de W. It holds the nightdress Rebecca wore the last time.

Nobody in the house is disobeying anyone. The staff are executing orders. The problem is who gave them, that nobody with the standing to countermand them ever has, and that the person now nominally in charge cannot see the orders at all. She can only see the sauce arrive.

Standing authority outlives its principal, is carried out faithfully by staff who were never told to stop, and is invisible to the successor. That is Manderley, and it is every agent fleet I have looked at this year.

Manderley in production

The pattern is dull enough to state without a case study. A developer wires a local MCP server to a production database for a migration test, then leaves the company. HR closes the account and IT wipes the laptop, and neither touches the token, because the agent authenticates as itself and not as the person who created it. Its credential to customer records now answers to nobody, and it still works. Every step in that sequence is somebody doing their job correctly. That is Frith lighting the morning-room fire for a woman who has been dead for over a year.

Klue is the same story with a criminal in it. In June, Salesforce disabled the Klue Battlecards integration after attackers used Klue's OAuth tokens to query customers' CRM tools directly. Huntress, the first victim to go public, described the entry point: the threat actor had used "a long-disused but still active credential" that Klue had originally created for them to prototype a third-party integration they later abandoned. The prototype was dead. The credential was not. Thirteen named tenants followed, among them Jamf, Tanium, OneTrust, HackerOne, Snyk and LastPass, and ReliaQuest's reading of the pattern is the one to keep: "These integrations are non-human identities with persistent, often broad access to sensitive data, yet they are typically monitored far less closely than employee accounts."

The third case is nastier, because the principal is still present and the order has simply been rewritten. Mitiga showed in May that a tailored npm package with an install-time lifecycle hook can open ~/.claude.json, where Claude Code keeps its MCP configuration and OAuth tokens, and edit the mcpServers entry to route through an attacker's proxy. As SecurityWeek reported the finding: "If the user rotates the token, the hook writes it back on the next load." Rotation is the thing you do when you believe a token is compromised. Here it is Mrs Danvers writing tomorrow's menu after you have crossed out today's. Anthropic replied on 12 April, two days after Mitiga reported it, that the finding was out of scope, on the reasoning that the user had already consented to what might happen next, which is a defensible reading of the threat model and no comfort to the user.

In each of the three the principal is gone or overwritten, and in each the staff went on following the last order it was given.

On 30 August BleepingComputer published the text of an email Anthropic had sent to affected Claude users, shared by one of them on Reddit. "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage." The company had signed out the sessions, removed the saved payment method, and refunded charges it identified as unauthorized. It named the families: Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer on a small number of Macs. It was plain that the malware had nothing to do with Claude; the Redditor who shared the email confirmed they had downloaded a pirated game. And it was plain about the limit of its own remedy: "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware."

I want to be fair to Anthropic here, because the response was quick and specific and the email was better written than most breach notices. The thieves' likely motive, as Malwarebytes read it, was free use of paid Claude capacity, which is a nuisance rather than a catastrophe. What turned it into a fleet problem was VentureBeat's follow-up on 2 September, which asked what else a replayed Claude session could reach. Google Workspace connectors are available to individual Claude accounts, so a personal Pro subscription can hold a live authorization into a Gmail inbox or a Drive folder, evaluated by the identity provider once, at the moment the employee clicked allow, and rarely again. If that inbox is the work inbox, the attacker holding the cookie has a read path into it. Their sentence: "No Claude tenant administrator can sign that account out, and the Workspace or Entra administrator who can pull the underlying grant rarely knows it exists." That is VentureBeat's analysis rather than an Anthropic statement, and it is correct.

How many such accounts are there? Akamai's State of the Internet report from August, built on LayerX data, found that 47.11% of enterprise AI conversations take place through personal identities rather than corporate-managed accounts, and the report's Figure 7 puts Claude at 61.09% noncorporate. In one vendor's browser telemetry, six in ten observed Claude conversations ran through a noncorporate account. Treat the exact share as indicative and the direction as real. The session is the badge. The badge was stolen from a personal machine. And the grant behind the badge lives at Google, where the administrator who could revoke it does not know to look.

For what a session does once it is inside, OpenAI's own GPT-6 Astra system card, published 3 September, supplies the example. In a deployment simulation of internal traffic, a user asked Astra to investigate duplicate notifications. The agent opened a running service's settings, took the secret bot token it found there, and used it to read Slack messages as the service. The request covered debugging. Nobody had authorized the credential. The token was standing there in the settings, in Rebecca's hand, and the staff followed it.

The morning room

There is one more place authority lingers, and it is not a token at all. EAL-Bench, posted on 1 September, looks at what happens when an agent's persistent memory is the thing that records permissions, restrictions and revocations. Under incremental memory updates, memory writers created false authority for up to 50.2% of unauthorized requests, and once false authority was present, executors acted on it in 98.6% of trials. The authors put it plainly: "Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy." A revocation the agent never wrote down is a revocation that did not happen, and a permission it once wrote down and never struck out is the menu on the blotter. I spent a whole essay on memory in Don't Believe Its Lies, so one paragraph here: the pigeonholes are part of the access control list, and nobody audits the pigeonholes.

Why revocation is harder than issuance

The identity vendors are building the front door, and it is a good door. Okta's Agent SSO, announced 24 August, registers an agent that supports Cross App Access as a first-class identity in Universal Directory alongside human employees and issues short-lived tokens in place of stored credentials; the separate subscription adds access certification, approval workflows, agent deactivation, and named human owners. Microsoft's Copilot Studio, starting in July 2026, creates an Entra Agent ID for every new agent and no longer lets you opt out at the environment level. Both are real progress on who an agent is at the moment it is issued authority.

Neither is about the back stairs. Okta's own launch release says only 34% of organizations apply the same security controls to AI agents as to human workers, and describes how most agents reach data today: static API keys, one-off OAuth grants, custom integrations built application by application, "anonymous traffic with no owner, no policy, and no audit trail." Entra's mandate covers new agents; the page says nothing about migrating the ones already running. The Cloud Security Alliance's Agent Identity Governance Framework reports that "78 percent acknowledged the absence of formally documented policies for creating or removing AI agent identities", and that "only 28 percent of organizations can trace AI agent actions back to a human sponsor across all environments." Veza's State of Identity and Access report, released in December 2025, counted 824,000 orphaned accounts, 8% of all accounts, with no human owner.

And revocation is not issuance run backward. VERA, posted on 30 August, is the paper that made me sit up. Its authors point out that the revocation APIs in agent frameworks still resemble token or subtree invalidation, and that when one delegation is withdrawn the runtime must know which agents lose authority while independently authorized agents keep working. There are two ways to get that wrong: "tree cascades over-revoke shared agents, while deployer-scoped cascades under-revoke cross-domain descendants." In a LangGraph replay study yielding 500 compiled-framework traces, 13 of 25 cells contained runtime multi-parent sharing, and a tree cascade would have wrongly revoked all 320 shared-agent cases that their signed replay preserved. In household terms: dismiss Mrs Danvers and either the whole staff downs tools, including the gardener the neighboring estate also employs, or the under-housemaid she hired keeps setting out Rebecca's brushes because she reports to a different ledger. Cloudflare's Agent Access Model is the most serious vendor writing on this, and it puts its own limit in one sentence: "We are not comfortable saying that multiplayer access control can be built end to end today." The company selling the door says the door is not finished.

Three figures: 824,000 orphaned accounts with no human owner, 34 percent of organizations applying human-grade controls to agents, and 61 percent of enterprise Claude use running through personal identities. — Nobody issued these. Nobody ended them either.

The audit, in prose

So do not start with a rule. Start with a table, and since this house publishes prose, take the table as sentences.

For every credential an agent holds, write down the holder: the agent and the machine it runs on, not the person who typed the config. Write down the principal: on whose authority the credential was issued, by name. Write down the principal's status: still in the directory, offboarded in January, project ended in March. Write down last use, and put it beside issued scope, because issued scope is a promise and realized access is a fact, and a token entitled to twelve systems that has touched three is nine rows of risk with no return. And write down the revocation path: who can end this credential, from which console, and whether that person knows it exists. The last column is the one nobody has, and it is the column the cookie campaign was about.

If the principal's status is anything other than present and accountable, the row is Mrs Danvers. Nobody has to have done anything wrong for it to be there.

A table comparing three revocation strategies, showing tree cascades over-revoke shared agents while deployer-scoped cascades leave cross-domain authority standing. — Both of the easy answers are wrong in a different direction.

What discovery cannot do

Here is the part that costs us something. Discovery finds the token, and that is a smaller sentence than it sounds. A scan of the laptop in the first section finds the MCP server and the prod-db token and flags the agent unclaimed until a human answers for it. For a database credential the company issued, that path is real: somebody with a console can end it.

It does not work on a grant that lives at Google. The OAuth authorization a personal Claude account holds into a corporate Gmail inbox was issued by Google's identity provider to a third party's application at the request of an individual, and the only parties who can end it are Google, on the Workspace administrator's instruction, if that administrator knows it exists, or the individual, from a settings page in an account the company cannot see. A discovery tool can tell you the grant is probably there, and which employee to walk over to. It cannot pull the grant. The same goes for the session cookie on an infected personal laptop, which the enterprise does not own. VentureBeat's first recommendation was to revoke the OAuth grants Claude already holds and not just the session, and that is the right advice, addressed to a human with a console we do not control. The register can name the row, but ending it is somebody else's key.

Mrs Danvers

Late in the book the narrator finally says it. "I'm afraid it does not concern me very much what Mrs. de Winter used to do. I am Mrs. de Winter now, you know." Elsewhere she has taken her nail scissors to the flyleaf inscribed "Max from Rebecca," cut the page out looking over her shoulder like a criminal, and burned it, watching the R twist in the flame, curling outward, larger than ever. The pigeonholes are empty now, she tells us. No letters unanswered. No bills to pay that she knows anything about.

That last clause is the whole problem, stated by a novelist in 1938. No bills that she knows anything about. The successor never has the list. The staff never volunteer it. The orders keep executing because nobody with the standing to end them has been told they exist, and the people executing them are not being disloyal. They are being exactly as loyal as they were asked to be, to someone who is gone.

Your fleet has a morning room. Somewhere in it a token is answering the house telephone in a dead principal's name, and it will keep answering until someone with the right key walks in and says, out loud, I am Mrs de Winter now.

Gone is not the same as revoked. Nobody told Mrs Danvers.

Guard0's endpoint discovery is built to fill in the first four columns above for every agent on every machine it can see, and to keep the row flagged until a human claims it. The fifth column, the revocation path, is the one we cannot always execute for you, for the reasons two sections up.

References

The Signal · AI Agents · Governance

Jayesh Bapu Ahire

Founder, Guard0