I am assuming the prompt is for the username / password for the domain. Internally you are likely getting through the AD authentication check in your application as you will have permissions to deliver the report (you can test that premise with Firefox or other browser that doesnt handle AD authentication like IE does.
I think you may have setup for basic authorisation to view the report RSReportServer.config rather than web.config is that what you have done? (see this to see example
http://msdn.microsoft.com/en-us/library/cc281309.aspx.
If you are trying to get full anonymous access then you are in for some fun; luckily one of the RS team blogged a way to achieve it; I wouldn't advocate doing it straight onto a production box though.
you can check this blog also
http://blogs.msdn.com/b/jameswu/archive/2008/07/15/anonymous-access-in-sql-rs-2008.aspx