The games' file format was decrypted last week, and since then, screenshots of new Pokémon have been circulating on places like Reddit and Pokémon fan sites. An anonymous source confirmed three of them to Kotaku; here's the obligatory spoiler alert before you read on.
The Pokémon in question are called Diancie, Volcanion and Hoopa; you can see a screenshot of each of them on Kotaku. Diancie is a rock/fairy type creature known in the game as a "Jewel Pokemon," and can compress airborne carbon into diamonds between its hands, according to its Pokédex entry.
It's unclear whether the three Pokémon are Legendary, but they could be "event" Pokémon — Pokémon that Nintendo releases for a limited time at promotional events.
You can read our full review of Pokémon X and Y here.