There's a stick lying on the ground in the woods. It previously was unknown by any agent, so it was purposeless.

I pick it up and start using it to steady myself as I hike. Now, it's a walking stick. Its purpose to me is to help me walk. I didn't create it. But I started using it, thereby creating a new entity--though the stick itself is physically unchanged.

In the computer example, the vulnerability gains purpose the moment that an intruder becomes aware of it. Previously, it merely had potential purpose.

What you're calling the act of "creation" can be as simple as the creation of an "intent to use" connection in the mind of an agent.