If one source remains uncompromised plus statistically random on all bits, and both sources remain independent, then a xor of both sources together can also be considered uncompromised plus statistically random for all bits.
Basic proof:
Label the the results two RNGs $X$ and $Y$, consider bits $X_n$, $Y_n$ and $Z_n = X_n \oplus Y_n$
Assume each value of $X$ remains uncompromised, such that $p(X_n=1) = 0.5$, and that each value of $Y$ is compromised so that $p(Y_n=1) = w$, the following holds assuming $X$ and $Y$ are independent:
$p(Z_n=1) = p(X_n=1) * p(Y_n=0) + p(X_n=0) * p(Y_n=1)$
$ = 0.5 * (1.0-w) + 0.5 * w$
$ = 0.5$
In other words, each bit of $Z$ retains the same probabilities and qualities of $X$, if $X$ is from a good RNG, then $Y$ can then be anything at all (provided it is independent of X). This holds even if $p(Y_n=1)$ is not independent of $p(Y_m=1)$, because whatever distribution you provide for $Y$, it just cancels out as above.
Knowing the exact value of $Y$ is just a special case of the above where $p(Y_n=1)$ is either 0 or 1 for each $n$. It doesn't grant any knowledge about $Z$, because each bit of $Z$ remains independent from each other bit of $Z$ and an attacker still only knows $p(Z_n=1) = 0.5$
Using a secure hash-based mixing method might allow you to relax the requirement for independence between the RNGs.
Entropy mixing with secure hashes can also be used to flatten distributions from sources which are not flat e.g. event timing data. You generally don't have that problem when the sources you are considering are well-written RNGs in the first place.
xorwould be a poor choice, whilst hashing would remain ok. Although that is quite contrived (if attacker can route one RNG, they are likely to be able to view it too) $\endgroup$ – Neil Slater Jun 11 '14 at 5:32