https://www.theverge.com/2017/11/13/16642690/bkav-iphone-x-faceid-mask

Vietnamese cybersecurity firm Bkav claims it's been able to bypass the iPhone X's Face ID feature using a mask. The mask is made to trick Apple's depth mapping and the result is a kind of creepy hybrid monster head with realistic cutouts for the eyes, nose and mouth.

Bkav says the mask is crafted through a combination of 3D printing, makeup, and 2D images. There's also some "special processing done on the cheeks and around the face" where there are large areas of skin, and the nose is created from silicone. The demo video shows the iPhone being unlocked using the researcher's face and then again using the mask, in just one go.