If you run Sierra, its agents are about to start signing in to websites on your behalf, and the credentials they use become a contract question you should settle before the feature reaches your tenant. If you built on Anon, you now depend on a product whose new owner has said nothing about its future. Sierra announced on November 5, 2026 that it acquired Anon, a startup that builds the login, browser and credential plumbing that lets an AI agent operate a website with no API. Terms were not disclosed. The stated purpose is to let Sierra's Horizon agents finish long jobs, such as originating a loan or getting a prior authorization, that stall at a portal.
Two groups of readers have different jobs this month. Sierra customers need to decide which portals, if any, they will let a vendor agent log in to, and on whose credentials. Anon's direct customers need a written answer on support, pricing and shutdown terms, and a fallback.
What Sierra Actually Bought From Anon
Sierra bought a team and an authentication layer for agents. In the announcement, Anon co-founder Daniel Mason describes the stack as "authentication and credential handling, browser infrastructure, an agent harness, and an SDK developers could embed in their products." He says Anon raised more than $13M, served "hundreds of customers" from AI startups to public companies, and completed hundreds of thousands of complex tasks in production. Those are the company's own figures; no customer count or revenue has been published independently.
The company started narrower. When Anon announced $6.5M in April 2024, led at seed by Union Square Ventures and Abstract Ventures, it pitched a developer toolkit that gave AI apps access to user accounts on sites without APIs. USV's Nick Grossman called it "the identity layer" for agents. Mason's post says the team later framed the idea as "Plaid for AI agents," and that it built agents for banking, healthcare and enterprise software customers, some of whom already buy from Sierra.
Anon's own site carries the security claims a buyer will ask about. The homepage says credentials are "never stored" and are streamed through isolated environments, lists a SOC 2 Type II report completed in July 2025, and promises a 99%+ uptime SLA with 24/7 on-call support. It also now shows a banner reading "Anon has been acquired by Sierra," and nothing about new sign-ups, migration or end of life.
Why Sierra Needs Logins for Horizon
Horizon is the part of Sierra that runs for days or months, and long jobs break at the first system with no API. Sierra's Horizon page describes agents that coordinate payers, providers and patients over phone and SMS, including a scenario where the agent handles a denied prior authorization by contacting the payer and rescheduling the visit. Customers "pay for results, not tokens." The healthcare example on that page uses EHR and scheduling systems; payer portals are where an agent without a browser stops.
Sierra built Horizon partly by acquisition. It bought Takeoff, a long-horizon agent runtime for lending and healthcare, on July 23, 2026, and earlier acquired Fragment, a YC-backed French startup, in April with terms undisclosed. Anon fills the next gap. Dealroom's write-up puts Sierra's total funding at $1.6B and repeats an estimate that about 70% of enterprise systems lack a robust API; treat that figure as directional, since the article gives no study behind it.
The strongest case for the deal is plain. A loan file or a prior auth touches a dozen systems, and many of them are a login page and a form. An outcome-priced agent that cannot get past the login does not get paid, so Sierra has a direct incentive to make browser work reliable. Mason calls reliability "the hardest problem in browser use," and says Anon's agents were built to handle multi-factor authentication, run for hours on one task and recover when a page changes.
The Credential Question Sierra Buyers Should Ask Now
A browser agent that logs in is acting as a user, so whoever holds the password holds the account. That is the risk this deal moves into your Sierra contract. Even the model vendors hedge on it: Anthropic's computer use documentation advises "avoiding giving the model access to sensitive data, such as account login information," limiting browsing to an allowlist of domains, and asking a human to confirm consequential actions. It warns that using computer use inside logged-in applications "increases the risk of bad outcomes as a result of prompt injection."
Anon's answer was architectural: stream credentials through an isolated environment and never store them. That claim was made about Anon's own platform, with Anon's SOC 2 report behind it. Nothing published yet says how the capability will run inside Sierra, under which audit scope, or whether the same no-storage design carries over.
There are three credential models you will run into, and each puts liability somewhere different:
- Your service account on a partner portal. The agent logs in as your company to a payer or lender portal. Your agreement with that portal operator, and its terms of service, decide whether an automated agent is allowed at all.
- Your customer's own credentials. The agent logs in as the end customer. This is the model banks have started to resist; Schwab and JPMorgan already block outside agents using customer logins.
- Delegated, scoped access through OAuth or a protocol such as the one Meta is building with Sierra, covered in our Personal Agent Protocol piece. This is safer when the site supports it, which most legacy portals do not.
Healthcare has a dated escape hatch for part of this. CMS's interoperability rule requires a Prior Authorization API by January 1, 2027 for Medicare Advantage plans, state Medicaid and CHIP programs, Medicaid and CHIP managed care, and qualified health plans on the federal exchanges (drugs are excluded). For those payers, a portal login is a stopgap with less than two months left before the API deadline. Payers outside that list have no such deadline under the rule, and that is where browser agents will keep working.
What Anon's Existing Customers Should Expect
Anon customers have no public commitment on product, support or pricing, and Sierra's recent history suggests you should not assume one. Sierra's post on Anon does not mention the standalone product. When Sierra bought Takeoff in July, CMSWire reported no statement on whether Takeoff's product would continue or what happened to its customers. Sierra sells agents to enterprises; it has not sold a developer SDK for browser automation, and a buyer folding a team into its own roadmap often stops selling the old product to outsiders.
That may be wrong here, and Sierra may keep the SDK alive for customers who overlap with its own base. A banner on the homepage is no substitute for a letter from the account team. If your product embeds Anon's SDK, the dependency is deeper than a vendor swap: your users' sessions, MFA flows and stored workflows sit on infrastructure that now belongs to a company that may compete with you in CX.
The alternatives are known. Browserbase sells hosted browsers from $20 a month for 100 browser hours to $99 for 500, with SOC 2, a HIPAA BAA on its custom Scale plan, and SSO at that tier; its pricing page describes no credential vault, so you would build or buy that piece. Our Browserbase vs Playwright vs computer use comparison argues for a scripted Playwright flow with a model as the fallback. RPA vendors cover the same ground with more governance and more cost; see our UiPath alternatives guide.
What to Do About It
This Week:
- If you use Anon directly, email your account contact and ask four things in writing: how long the current product and SLA will run, whether pricing is frozen through your term, what notice you get before shutdown, and how you export workflows and logs.
- If you buy Sierra, ask your account team whether Anon's browser capability will be on by default in your tenant, or opt-in per portal.
This Month:
- List every portal a Sierra or Horizon agent might need to log in to, and mark whose credentials it would use: yours, your customer's or a delegated token.
- Ask Sierra for the audit scope that will cover browser sessions, and whether Anon's no-storage design for credentials carries over. Ask for the answer from Sierra's security team in writing.
- For each partner portal on that list, check its terms of service for automated access before an agent touches it. See our AI Agent Accountability Act explainer for where liability lands on the company running the agent.
Before Renewal:
- Add contract language that names browser-session logs as your data, requires per-action audit trails for any logged-in agent session, and requires human confirmation for payments, submissions and terms acceptance.
- For healthcare payers covered by the CMS rule, plan to move prior auth from portal login to the payer's API once it exists, and price the Horizon outcome accordingly.
The Bottom Line
Screen scraping has been through this cycle before. Fintech aggregators logged in with customers' bank passwords for years until banks pushed them toward tokenised APIs, and the agents doing the same job now are meeting the same resistance from the same banks. Sierra is betting that outcome-priced agents need the browser in the meantime, and for portals that will never ship an API, that bet is probably right.
For you, the purchase changes one thing: your CX vendor now owns a tool that logs in as someone. Decide whose login it can use before the first Horizon agent asks for one.
Continue Reading
- Browserbase vs Playwright vs Computer Use: The Script Still Wins
- Schwab and JPMorgan Block AI Agents Using Customer Logins
- Meta's Personal Agent Protocol Signs Walmart Before It Has a Spec
- OpenAI's Hosted Browser Agent Asks Once Per Site, Not Per Purchase
- Why Sierra Just Raised $950M to Kill the Contact Center
- Five9 to Acquire Level AI for $325M, Keep Selling to Rivals