The flaw is the vulnerability, the code that abuses it is the exploit, and its use against a target is the attack. A zero-day stops being one when a patch ships, after which it becomes an n-day. AI agents are speeding up how fast both researchers and attackers find them.