I have seen an analysis where the predictive abiity of a number of predictors is each assessed individually by a univariable Cox PH model and the "AUC" reported (presumably Harrell's c-statistic, I will check). The model fitting and AUC calculation are performed on the same entire data set. Is this OK ? Overfitting is an issue when multivariate models are built and a correcion for optimism (test/training, crossvalidation or bootstrapping) a must. But even a single coefficient from a univariable model is overfitted in the sense of fine tuned to the data set its estimated from and will therefore predict that same data set better than new data.