#1295 Gemini 3.7 Flash provider content filtering causes Strix agents to fail during autonomous security scans

Description When running an autonomous Strix scan against a locally hosted DVWA instance using Gemini 3.7 Flash, the scan starts successfully and Strix is able to execute agents and make LLM calls.

However, multiple agents subsequently fail with a provider refusal:

ModelRefusalError: Model refused to produce output: Response withheld by the provider's content filter.

The scan itself can continue, but the affected agents are marked as failed, which may reduce scan coverage/completeness.

To Reproduce

Start a local DVWA instance.
Configure Strix to use Gemini 3.7 Flash with gemini/gemini-3.7-flash.
Run: strix -n --target http://localhost --scan-mode quick --max-budget 5
Allow the scan to proceed.
Observe that multiple agents eventually fail with ModelRefusalError.

Expected behavior I would expect Strix to handle provider-side refusals in a way that does not silently reduce scan coverage, assuming Gemini 3.7 Flash is a supported model for this workflow.

If provider-side content filtering is an expected limitation for autonomous security-testing workloads, I would expect this limitation to be documented and/or the refusal to be surfaced clearly in the final scan results so it can be distinguished from an actual Strix agent/tool failure.

System Information:

OS: Windows 11 x86_64
Strix Version or Commit: 1.6.2
Python Version: 3.13.15
LLM Used: Gemini 3.7 Flash (gemini/gemini-3.7-flash)

Additional context The Gemini API key and model availability were independently verified before running Strix, and the DVWA target was confirmed reachable.

Strix was able to successfully communicate with Gemini and perform substantial work before the refusals occurred, so this does not appear to be an authentication, connectivity, or target availability issue. The refusal occurred for multiple agents during the same scan. At the time of the observed failures, the scan was still in progress.

The Strix output showed:

Input Tokens: 9.4M
Cached Tokens: 8.3M
Output Tokens: 42.0K
Cost: $1.5889

Two separate agents were marked as failed with the same ModelRefusalError and provider content-filter message.

My current assumption is that the affected requests are being rejected by Gemini's provider-side content filtering, but I have not independently confirmed the exact trigger for the refusal.